Critical severity9.1OSV Advisory· Published Mar 7, 2025· Updated Apr 15, 2026
CVE-2025-27603
CVE-2025-27603
Description
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't have programming rights can execute arbitrary code due to an unescaped translation when creating a page using the Migration Page template. This vulnerability is fixed in 1.2.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.xwiki.confluencepro:application-confluence-migrator-pro-uiMaven | >= 1.0, < 1.2.0 | 1.2.0 |
Affected products
2- Range: application-confluence-migrator-pro-1.0, application-confluence-migrator-pro-1.0.1, application-confluence-migrator-pro-1.1.0
- ghsa-coordsRange: >= 1.0, < 1.2.0
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-6qvp-39mm-95v8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-27603ghsaADVISORY
- github.com/xwikisas/application-confluence-migrator-pro/commit/36cef2271bd429773698ca3a21e47b6d51d6377dnvdWEB
- github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-6qvp-39mm-95v8nvdWEB
News mentions
0No linked articles in our index yet.