CVE-2025-65036
BaseFortify
Publication date: 2025-12-05
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xwiki | pro_macros | to 1.27.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in XWiki Remote Macros prior to version 1.27.1, where the macro executes Velocity code from details pages without checking user permissions. This lack of permission validation allows an attacker to execute arbitrary code remotely.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can perform remote code execution, potentially leading to unauthorized access, data compromise, or disruption of services on the affected system.
What immediate steps should I take to mitigate this vulnerability?
Upgrade XWiki Remote Macros to version 1.27.1 or later, as this version contains the fix for the vulnerability that allows remote code execution by executing Velocity without permission checks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of CVE-2025-65036 involves identifying if your system is running XWiki Remote Macros version 1.27.0 or earlier, which are vulnerable. Since the vulnerability is exploited by creating pages with specific macros executing Velocity templates without permission checks, you can check for the presence of the 'detailssummary' macro usage in your XWiki pages and verify if any pages contain asynchronous macro calls embedding Groovy code. There are no specific commands provided in the resources, but you can audit your XWiki instance by searching for pages containing the 'detailssummary' macro and reviewing user permissions and recent page edits for suspicious macro usage. Upgrading to version 1.27.1 or later is recommended to remediate the issue. [1]