CVE-2025-53836: XWiki Rendering Transformation Macro Vulnerable to RCE Attacks
Summary
CVE-2025-53836: XWiki Rendering is vulnerable to RCE attacks when processing nested macros. Affects org.xwiki.rendering:xwiki-rendering-transformation-macro across 3 version ranges.
>= 4.2-milestone-1, < 13.10.11
>= 14.0, < 14.4.7
>= 14.5, < 14.10
Fixed in 13.10.11, 14.4.7 or 14.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The XWiki Rendering Transformation Macro is a component of the XWiki platform that allows users to create and manipulate content using various macros. It is designed to enhance the functionality of XWiki by enabling the execution of complex transformations and rendering tasks. However, this package has a critical vulnerability that allows unauthorized execution of scripts, leading to potential remote code execution (RCE).
Vulnerability Detail
The vulnerability arises from the default macro content parser failing to preserve the restricted attribute of the transformation context when executing nested macros. This oversight permits the execution of macros that are typically forbidden in restricted mode, particularly script macros. For instance, using specific XWiki syntax within comments can escalate privileges from comment rights to programming rights, allowing for remote code execution. The vulnerability has existed since version 4.2 and affects various bundled macros, including the cache and chart macros.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2-milestone-1, < 13.10.1113.10.11 -
>= 14.0, < 14.4.714.4.7 -
>= 14.5, < 14.1014.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, comments can be disabled for untrusted users to prevent exploitation of this vulnerability until an upgrade to a patched version is completed. Note that users with edit rights can still add comments via the object editor even if comments are disabled.
Conclusion
CVE-2025-53836 is a critical vulnerability in the XWiki Rendering Transformation Macro that poses significant risks of remote code execution. It is essential to update to the patched versions to secure your application. Until then, implementing workarounds can help mitigate the risks.
See every vulnerability recorded for org.xwiki.rendering:xwiki-rendering-transformation-macro →
FAQ
CVE-2025-53836 is a critical vulnerability in the XWiki Rendering Transformation Macro that allows for remote code execution due to improper handling of nested macros.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can identify if your application is affected by this vulnerability.
If exploited, this vulnerability could allow an attacker to execute arbitrary code on the server, potentially leading to data breaches or complete system compromise.
If immediate upgrading is not possible, disable comments for untrusted users to mitigate the risk of exploitation until a patch can be applied.
Additional information can be found in the advisory on GitHub and related Jira tickets that discuss the vulnerability and its implications.
