Medium severity4.4NVD Advisory· Published May 4, 2026· Updated May 7, 2026
CVE-2026-42140
CVE-2026-42140
Description
PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue has been patched in version 2.4.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.xwiki.contrib.plantuml:macro-plantuml-macroMaven | < 2.4.1 | 2.4.1 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-42fc-7w97-8vrcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42140ghsaADVISORY
- github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5cnvdWEB
- github.com/xwiki-contrib/macro-plantuml/security/advisories/GHSA-42fc-7w97-8vrcnvdWEB
- jira.xwiki.org/browse/PLANTUML-25nvdWEB
News mentions
0No linked articles in our index yet.