CVE-2025-27603 XWiki Confluence Migrator Pro allows Remote Code Execution via unescaped translations
Attackers without programming rights can execute arbitrary code via unescaped translations in the Confluence Migrator Pro plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27603?
CVE-2025-27603 is a critical code injection vulnerability in xwikisas application-confluence-migrator-pro, published on 7 Mar 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.
Weakness: CWE-95
Which versions are affected by CVE-2025-27603?
2 open source packages ship an affected version, including com.xwiki.confluencepro:application-confluence-migrator-pro-ui.
| Package | Affected | Fixed in |
|---|---|---|
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Maven | From 1.0 | 1.2.0 |
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Maven | From 1.0 | 1.2.0 |
How do I fix CVE-2025-27603?
Upgrade com.xwiki.confluencepro:application-confluence-migrator-pro-ui to 1.2.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-27603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27603 exists.
Sources
Also known as GHSA-6qvp-39mm-95v8.