Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%

CVE-2025-55729 โ€” AI Deep Analysis Summary

CVSS 10.0 ยท Critical

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: CVE-2025-55729 is a critical RCE flaw in `xwiki-pro-macros`. It stems from **missing input escaping** for the `ac:type` parameter.โ€ฆ

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: **CWE-116** (Improper Encoding/Escaping of Info). The system fails to sanitize the `ac:type` argument. This allows malicious payloads to slip through as executable code instead of plain text.โ€ฆ

Q3Who is affected? (Versions/Components)

๐Ÿ“ฆ **Affected**: **xwiki-pro-macros** by **xwikisas**. ๐Ÿ“‰ **Version**: All versions **prior to 1.26.5**. โœ… **Fixed**: Version 1.26.5 and later are safe. ๐Ÿข **Vendor**: XWiki SAS.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’ป **Hackers' Power**: Full **Remote Code Execution**. They can run arbitrary commands on the server. ๐Ÿ”“ **Privileges**: System-level access.โ€ฆ

Q5Is exploitation threshold high? (Auth/Config)

๐Ÿ”“ **Threshold**: **LOW**. ๐ŸŒ **Network**: Attack Vector is Network (AV:N). ๐Ÿšซ **Auth**: No Privileges Required (PR:N). ๐Ÿ‘๏ธ **UI**: No User Interaction needed (UI:N). You can exploit this remotely without logging in.

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ•ต๏ธ **Public Exploit**: **No**. The `pocs` field is empty. ๐Ÿ“ **References**: Links to Jira, GitHub commits, and GHSA advisories exist, but no public PoC code is provided in this data.โ€ฆ

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: Scan for `xwiki-pro-macros` components. ๐Ÿ“‹ **Version Audit**: Check if your version is **< 1.26.5**. ๐Ÿงช **Test**: Look for unsanitized `ac:type` parameters in macro inputs.โ€ฆ

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿ”ง **Official Fix**: **YES**. Update to **version 1.26.5** or higher. ๐Ÿ“ฅ **Patch**: Available via GitHub commit `06e6cf3...` and GHSA advisory `GHSA-22xj-jpjg-gpgw`.โ€ฆ

Q9What if no patch? (Workaround)

๐Ÿšง **No Patch Workaround**: If you cannot upgrade immediately: 1. **Restrict Access**: Block external network access to the macro endpoints. 2.โ€ฆ

Q10Is it urgent? (Priority Suggestion)

๐Ÿ”ฅ **Urgency**: **CRITICAL**. โฑ๏ธ **Priority**: **P0**. With CVSS 10.0 and no auth required, this is a high-priority target for attackers. ๐Ÿš€ **Action**: Patch immediately upon availability. Do not delay.