CVE-2025-65089: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2025-65089) has been identified in XWiki Pro Macros affecting versions 1.26.20 and earlier. The vulnerability allows users without proper view permissions to access the content of office file attachments through the view file macro on public pages. This security flaw was discovered and published on November 18, 2025 (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 score of 6.8 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. The attack vector is Network-based, with low attack complexity, requiring low privileges and user interaction. The scope is changed, with high impact on confidentiality but no impact on integrity or availability (GitHub Advisory).

The vulnerability allows unauthorized access to private data when a user knows the reference to an attachment and has edit rights on a page. Specifically, if an office attachment from a restricted page is displayed on a public page, users without view rights on the restricted page can view the attachment content, regardless of the display type used (GitHub Advisory).

The vulnerability has been patched in version 1.27.0 of XWiki Pro Macros. No workarounds are available for affected versions, making it critical to upgrade to the patched version (GitHub Advisory).