CVE-2026-44179: 
Java vulnerability analysis and mitigation

CVE-2026-44179 is a critical XWiki syntax injection vulnerability in the xwiki-pro-macros package that allows remote code execution via the excerpt-include macro. The macro fails to properly escape the title of the included page and executes excerpt content with the macro's elevated rights, enabling any user with page-edit access to execute arbitrary Groovy code. Affected versions are com.xwiki.pro:xwiki-pro-macros >= 1.13 and < 1.14.5; version 1.14.5 contains the fix. It carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, XWiki Advisory). The vulnerability was published on June 21, 2026, and added to the GitHub Advisory Database on June 22, 2026.

The root cause is improper neutralization of directives in dynamically evaluated code (CWE-95, Eval Injection). Specifically, ExcerptInclude.xml at line 277 does not escape the title of the included page before rendering it as XWiki syntax, and the content of the {{excerpt}} macro is rendered and output into the macro's execution context with the macro's own (elevated) rights. An attacker with only basic page-edit privileges — no script or programming rights required — can craft a page whose title or content contains XWiki macro syntax (e.g., {{async}}{{groovy}}...{{/groovy}}{{/async}}), which is then executed server-side when the excerpt-include macro processes the page (GitHub Advisory, XWiki Advisory). A public proof-of-concept is included in the advisory.

Successful exploitation results in full remote code execution on the XWiki server, impacting the confidentiality, integrity, and availability of the entire XWiki installation. An attacker can read sensitive data stored in the wiki, modify or delete content, and potentially disrupt service availability. Because the injected code executes with the macro's rights (which may be elevated), the scope of impact extends beyond the attacker's own user context to the broader XWiki environment (GitHub Advisory, XWiki Advisory).

1. Obtain page-edit access: Log in to the target XWiki instance as any user with permission to create or edit pages (no script or programming rights needed).
2. Create a new page: Create a page named Exploit (or any name) in the XWiki instance.
3. Inject payload into the page title: In the edit screen, change the page title to a malicious XWiki macro string, e.g., {{async}}{{groovy}}println("Hello from Groovy Title!"){{/groovy}}{{/async}}.
4. Inject payload into page content: Set the page content to include the excerpt-include macro referencing the same page, along with an excerpt block containing a Groovy payload:

{{excerpt-include 0="Exploit.WebHome"}}{{/excerpt-include}}
{{excerpt}}{{async}}{{groovy}}println("Hello from Groovy content!"){{/groovy}}{{/async}}{{/excerpt}}

5. Save and view the page: Save the page and navigate to it. The excerpt-include macro processes the page title and excerpt content without escaping, executing the embedded Groovy code with the macro's elevated rights.
6. Confirm code execution: If the output displays Hello from Groovy Title! or Hello from Groovy content! without surrounding macro syntax, arbitrary code execution has been achieved. Replace the println payload with destructive or exfiltration commands as desired (GitHub Advisory, XWiki Advisory).

• Logs: XWiki rendering or server logs showing Groovy script execution originating from the excerpt-include macro context; unexpected println output or stack traces in wiki rendering logs.
• Wiki Content: Pages with titles or content containing XWiki macro syntax such as {{async}}, {{groovy}}, or {{async}}{{groovy}} patterns, especially created by low-privileged users.
• Process/Application: Unexpected outbound network connections or file system changes initiated by the XWiki Java process following page view events; unusual Groovy script execution in the application server logs.
• Audit Logs: XWiki audit trail entries showing page creation or title edits by low-privileged users followed shortly by page view events that trigger macro rendering (GitHub Advisory).

Upgrade com.xwiki.pro:xwiki-pro-macros to version 1.14.5 or later, which contains the fix for this vulnerability. No configuration-based workaround is described in the advisory; upgrading is the only recommended remediation. Administrators should also audit existing wiki pages for titles or content containing suspicious XWiki macro syntax (e.g., {{groovy}}, {{async}}) created by low-privileged users (GitHub Advisory, XWiki Advisory).