CVE-2025-27604: XWiki Confluence Migrator Pro's homepage is public
Impact The homepage of the application is public which enables a guest to download the package which might contain sensitive information.
Patches 1.11.7
Workarounds The access to the page can be manually restricted to a specific set of users or groups.
Other sources
XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.xwiki.confluencepro:application-confluence-migrator-pro-uito a version that resolves this vulnerability.Fixed in 1.11.7 - Upgrade
Upgrade
XWiki Confluence Migrator Proto a version that resolves this vulnerability.Fixed in 1.11.7 - Configuration
Manually restrict access to the product homepage to a specific set of users or groups so guests cannot download the package that might contain sensitive information.
XWiki Confluence Migrator Pro Homepage access = restricted to a specific set of users or groups
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27604?
CVE-2025-27604 has a severity level that indicates potential exposure of sensitive information due to unauthorized package downloads.
How do I fix CVE-2025-27604?
To fix CVE-2025-27604, upgrade XWiki Confluence Migrator Pro to version 1.11.7 or later.
What specific vulnerability does CVE-2025-27604 address?
CVE-2025-27604 addresses a public exposure vulnerability allowing guests to download potentially sensitive package contents.
Who is affected by CVE-2025-27604?
Users of XWiki Confluence Migrator Pro versions prior to 1.11.7 are affected by CVE-2025-27604.
When was CVE-2025-27604 disclosed?
CVE-2025-27604 was disclosed in 2025, highlighting the vulnerability present before the fix in version 1.11.7.