CVE-2026-44179

Summary

The `excerpt-include` macro in XWiki Remote Macros versions 1.13 through 1.14.4 allows unauthenticated syntax injection via the included page's title and excerpt content, leading to remote code execution when a page is rendered, due to insufficient escaping and unsafe macro execution with the macro's privileges.

Exploitability

Exploitation requires only basic edit permissions on a page (no script or programming rights) and knowledge of how to inject malicious macro syntax into the title or excerpt content.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability across the entire XWiki installation, as the macro executes with its own elevated privileges.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to XWiki Remote Macros version 1.14.5 or later, which patches the vulnerability in the `excerpt-include` macro.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.