Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.xwiki.contrib.plantuml:macro-plantuml-macro

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.4MavenPublished

    XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter

    CVE-2026-42140 · GHSA-42fc-7w97-8vrc

    Affected
    • Maven org.xwiki.contrib.plantuml:macro-plantuml-macro < 2.4.1
    Fixed in
    2.4.1· Vendor fix available
    Issue
    Impact The PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue affects all versions of the Plant UML Macro extension till version 2.4 included. Patches Version 2.4.1 of the Plant UML Macro extension fixes the issue by verifying if the supplied server domain matches one of the trusted domain configured inside of XWiki. Workarounds Protect the XWiki server by placing it in a DMZ so that it cannot access any other internal servers. Resources The issue was fixed in PLANTUML-25 by the commit c8b19bda93058794e04c8862fc7ca85c59b5fe5c. For more information If there are any questions or comments about this advisory: Open an issue in JIRA XWiki.org Send an email to…

    Recommended action: Upgrade to 2.4.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →