CVE-2025-65089: XWiki view file macro: User can view content of office file without view rights on the attachment

November 18, 2025 (updated November 19, 2025)

A user with no view rights on a page may see the content of an office attachment displayed with the view file macro.

References

github.com/advisories/GHSA-8c52-x9w7-vc95
github.com/xwikisas/xwiki-pro-macros
github.com/xwikisas/xwiki-pro-macros/security/advisories/GHSA-8c52-x9w7-vc95
nvd.nist.gov/vuln/detail/CVE-2025-65089

Code Behaviors & Features

Detect and mitigate CVE-2025-65089 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →