CVE-2025-27604 XWiki Confluence Migrator Pro's homepage is public
Guest users can access the public homepage to download migration packages, potentially exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27604?
CVE-2025-27604 is a high-severity vulnerability in xwikisas application-confluence-migrator-pro, published on 7 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.
Weakness: CWE-200
Which versions are affected by CVE-2025-27604?
2 open source packages ship an affected version, including com.xwiki.confluencepro:application-confluence-migrator-pro-ui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Maven | All versions | 1.11.7 |
com.xwiki.confluencepro:application-confluence-migrator-pro-ui Maven | All versions | 1.11.7 |
Products include Xwiki Confluence Migrator.
How do I fix CVE-2025-27604?
Upgrade com.xwiki.confluencepro:application-confluence-migrator-pro-ui to 1.11.7 or later.
Is CVE-2025-27604 being exploited?
There is no known exploitation of CVE-2025-27604 in the wild and no public exploit code.
Sources
Also known as GHSA-3w9f-2pph-j5vc.