CVE-2025-65089 XWiki view file macro: User can view content of office file without view rights on the attachment

What is CVE-2025-65089?

CVE-2025-65089 is a medium-severity missing authorization vulnerability in xwikisas xwiki-pro-macros, published on 19 Nov 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

Weakness: CWE-862

Which versions are affected by CVE-2025-65089?

2 open source packages ship an affected version, including com.xwiki.pro:xwiki-pro-macros-ui. It affects 1 product.

Products include Xwiki Pro Macros.

How do I fix CVE-2025-65089?

Upgrade com.xwiki.pro:xwiki-pro-macros-ui to 1.27.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-65089 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65089 exists.

Other vulnerabilities in xwikisas xwiki-pro-macros

• CVE-2025-55727 XWiki Remote Macros vulnerable to remote code execution from width parameter in the column macro Critical 10.0
• CVE-2025-55728 XWiki Remote Macros vulnerable to remote code execution using the panel macro Critical 10.0
• CVE-2024-42489 Pro Macros Remote Code Execution via Viewpdf and similar macros Critical 10.0
• CVE-2025-65036 XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8c52-x9w7-vc95.