CVE-2025-65089: 
Java vulnerability analysis and mitigation

XWiki Remote Macros, a tool providing rendering macros for content migration from Confluence, was found to contain a security vulnerability (CVE-2025-65089) disclosed on November 19, 2025. The vulnerability affects versions prior to 1.27.0, where users without view permissions could access the content of office attachments displayed with the view file macro (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. The vulnerability is characterized by Network attack vector, Low attack complexity, Low privileges required, Required user interaction, Changed scope, and High impact on confidentiality with No impact on integrity and availability (GitHub Advisory).

The vulnerability allows unauthorized access to private data. Specifically, if a user knows the reference to an attachment and has edit rights on a page, they can view the content of office attachments from restricted pages, even without proper view permissions (GitHub Advisory).

The vulnerability has been patched in version 1.27.0 of XWiki Remote Macros. No workarounds are available for earlier versions, making upgrading to the patched version the only solution (GitHub Advisory).