{"id":"CVE-2025-27604","aliases":["EUVD-2025-7797","GHSA-3w9f-2pph-j5vc"],"status":"published","title":"XWiki Confluence Migrator Pro's homepage is public","description":"XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00377,"percentile":0.31941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2025-03-07T16:11:32Z","modified":"2026-10-28T10:45:19Z","fixes":[{"ecosystem":"Maven","package":"com.xwiki.confluencepro:application-confluence-migrator-pro-ui","fixed_in":["1.11.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.xwiki.confluencepro:application-confluence-migrator-pro-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.11.6"},{"fixed":"1.11.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.xwiki.confluencepro:application-confluence-migrator-pro-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.7"}]}]}],"products":[{"vendor":"xwiki","product":"confluence_migrator"},{"vendor":"xwikisas","product":"application-confluence-migrator-pro"}],"references":[{"url":"https://github.com/xwikisas/application-confluence-migrator-pro/security/advisories/GHSA-3w9f-2pph-j5vc","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/xwikisas/application-confluence-migrator-pro/commit/6ced42b1f341fd0ce6734fc58c7d694da5f365fb","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27604","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3w9f-2pph-j5vc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27604.json","tags":["advisory"]},{"url":"https://github.com/xwikisas/application-confluence-migrator-pro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27604","title":"XWiki Confluence Migrator Pro's homepage is public","description":"XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.","status":"published","published":"2025-03-07T16:11:32.475Z","modified":"2025-03-07T17:56:42.64Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-7797","description":"XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.","status":"published","published":"2025-03-07T16:11:32Z","modified":"2025-03-07T17:56:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-3w9f-2pph-j5vc","title":"com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public","description":"### Impact\nThe homepage of the application is public which enables a guest to download the package which might contain sensitive information.\n\n### Patches\n1.11.7\n\n### Workarounds\nThe access to the page can be manually restricted to a specific set of users or groups.","status":"published","published":"2025-03-07T16:19:25Z","modified":"2025-03-07T19:16:57Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2025-27604","description":"XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.","status":"published","published":"2025-03-07T17:15:22.29Z","modified":"2026-06-17T09:03:53.897Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:53.101324Z"}],"osv":[{"id":"CVE-2025-27604","title":"XWiki Confluence Migrator Pro's homepage is public","description":"XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. The homepage of the application is public which enables a guest to download the package which might contain sensitive information. This vulnerability is fixed in 1.11.7.","status":"published","published":"2025-03-07T16:11:32.475Z","modified":"2026-10-28T10:45:19.365266139Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-3w9f-2pph-j5vc","title":"com.xwiki.confluencepro:application-confluence-migrator-pro-ui's application homepage is public","description":"### Impact\nThe homepage of the application is public which enables a guest to download the package which might contain sensitive information.\n\n### Patches\n1.11.7\n\n### Workarounds\nThe access to the page can be manually restricted to a specific set of users or groups.","status":"published","published":"2025-03-07T16:19:25Z","modified":"2025-03-07T19:16:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:36.092962Z"}]}}