This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis โ
Q1What is this vulnerability? (Essence + Consequences)
๐จ **Essence**: CVE-2025-55729 is a critical RCE flaw in `xwiki-pro-macros`. It stems from **missing input escaping** for the `ac:type` parameter.โฆ
๐ก๏ธ **Root Cause**: **CWE-116** (Improper Encoding/Escaping of Info). The system fails to sanitize the `ac:type` argument. This allows malicious payloads to slip through as executable code instead of plain text.โฆ
๐ฆ **Affected**: **xwiki-pro-macros** by **xwikisas**. ๐ **Version**: All versions **prior to 1.26.5**. โ **Fixed**: Version 1.26.5 and later are safe. ๐ข **Vendor**: XWiki SAS.
Q4What can hackers do? (Privileges/Data)
๐ป **Hackers' Power**: Full **Remote Code Execution**. They can run arbitrary commands on the server. ๐ **Privileges**: System-level access.โฆ
๐ **Threshold**: **LOW**. ๐ **Network**: Attack Vector is Network (AV:N). ๐ซ **Auth**: No Privileges Required (PR:N). ๐๏ธ **UI**: No User Interaction needed (UI:N). You can exploit this remotely without logging in.
Q6Is there a public Exp? (PoC/Wild Exploitation)
๐ต๏ธ **Public Exploit**: **No**. The `pocs` field is empty. ๐ **References**: Links to Jira, GitHub commits, and GHSA advisories exist, but no public PoC code is provided in this data.โฆ
๐ **Self-Check**: Scan for `xwiki-pro-macros` components. ๐ **Version Audit**: Check if your version is **< 1.26.5**. ๐งช **Test**: Look for unsanitized `ac:type` parameters in macro inputs.โฆ
๐ง **Official Fix**: **YES**. Update to **version 1.26.5** or higher. ๐ฅ **Patch**: Available via GitHub commit `06e6cf3...` and GHSA advisory `GHSA-22xj-jpjg-gpgw`.โฆ
๐ฅ **Urgency**: **CRITICAL**. โฑ๏ธ **Priority**: **P0**. With CVSS 10.0 and no auth required, this is a high-priority target for attackers. ๐ **Action**: Patch immediately upon availability. Do not delay.