关键漏洞信息 漏洞标题 Remote code execution using the confluence paste code macro 严重性 Critical CVSS v3 base metrics: 10.0 / 10 影响版本 Affected versions: >=1.0 Patched versions: 1.26.5 描述 Summary: Missing escaping of the title in the confluence paste code macro allows remote code execution for any user who can edit any page. Details: The classes parameter is used without escaping in XWiki syntax, thus allowing XWiki syntax injection which enables remote code execution. 证明概念 (PoC) As a user add the panel macro and in the classes parameter input or just using viewing rights using https://jira.xwiki.org/browse/XWIKI-20449 其他信息 CVE ID: CVE-2025-55730 Weaknesses: No CWEs