CVE-2025-65089 MEDIUM

CVE-2025-65089: XWiki view file macro: User can view content of office file without view rights on the attachment

Vendor Xwikisas

Product xwiki-pro-macros

Weakness CWE-862 · Missing authorization

Published November 19, 2025

Last update November 19, 2025

View on NVD All CVEs

CVSS base score

6.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

Key dates

02Disclosure timeline

November 19, 2025 CVE published

November 19, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-65089 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2023-33995 WordPress Photo Gallery by 10Web plugin <= 1.8.15 - Broken Access Control vulnerability CVE-2024-24718 WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability CVE-2023-0993 Shield Security <= 17.0.17 - Missing Authorization CVE-2025-23423 WordPress SendGrid for WordPress plugin <= 1.4 - Broken Access Control vulnerability CVE-2023-41671 WordPress Abandoned Cart Lite for WooCommerce plugin <= 5.16.1 - Cross Site Request Forgery (CSRF) vulnerability