Overview
CVE-2026-44179 is a critical code injection flaw (CVSS 9.9, CWE-95) in the excerpt-include macro of XWiki Remote Macros (xwiki-pro-macros), the package that provides Confluence-style macros for teams migrating content to XWiki. The NVD entry was published on October 28, 2026; the GitHub advisory (GHSA-w56x-9778-rppx) was published in June 2026.
Technical Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-44179 |
| CVSS v3.1 | 9.9 — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Weakness | CWE-95, eval injection |
| Vulnerable file | ExcerptInclude.xml in xwiki-pro-macros-ui |
| Privileges required | Low — ability to edit a page; script or programming rights are not needed |
The macro does not properly escape the included page's title, and it executes the excerpt content with the macro's own (elevated) rights. A low-privileged user can place executable XWiki macro syntax in a page title or excerpt; when another page includes it, the syntax runs with the rights of the macro. This allows arbitrary code execution and impacts the confidentiality, integrity and availability of the whole XWiki instance.
Affected Versions
- Affected:
xwiki-pro-macros1.13.0 up to, but not including, 1.14.5 - Fixed: 1.14.5 and later
Exploitation Status
VulDB lists no public exploit, and the flaw is not on the CISA KEV list at the time of writing. NVD analysis is still pending. Because exploitation requires only page-edit access, wikis that allow open registration or have many contributors carry the highest risk.
Remediation
- Upgrade Remote Macros to 1.14.5 or later through the XWiki Extension Manager.
- If you cannot upgrade immediately, restrict page-edit rights to trusted users and consider disabling or uninstalling the extension.
- Review page titles and excerpt blocks for unexpected macro syntax such as
{{groovy}}or{{velocity}}, and check page history for suspicious edits. - Audit the XWiki instance for new users, scripts, or extensions added since the vulnerable version was installed.