This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] XWiki Confluence Migrator Pro fixes 2 vulnerabilities

XWiki fixes 2 vulnerabilities in Confluence Migrator Pro with versions 1.2 and 1.11.7 [1][2].

XWiki - RCE (CVE-2025-27603)
CVSS 9.1 (Critical)

An authenticated remote attacker without programming rights can achieve remote code execution when creating a page using the Migration Page template [1].

The vulnerability is present in product:

  • *:XWiki Confluence Migrator Pro; >=1.0, <1.2

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-27603 at cve.org, NVD
  • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 7. 3. 2025.

XWiki - information disclosure (CVE-2025-27604)
CVSS 7.5 (High)

An unauthenticated remote attacker can download a package containing sensitive information from the home page [2].

The vulnerability is present in product:

  • *:XWiki Confluence Migrator Pro; <=1.11.6

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 7. 3. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 10. 3. 2025.

CESNET, z.s.p.o. Logo