CVE-2026-42140 Details
Description
PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue has been patched in version 2.4.1.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the XWiki PlantUML Macro, affecting versions prior to 2.4.1. The vulnerability arises because the macro allows users to specify an alternative PlantUML server via the 'server' parameter' without validating the supplied URL. This lack of validation enables attackers to send internal IP addresses or malicious external URLs, which the XWiki server will attempt to connect to in order to render diagrams. This could potentially be exploited to access internal services or resources.
Users can update to version 2.4.1 of the PlantUML Macro, which addresses the vulnerability by validating the 'server' parameter against a list of trusted domains. For those unable to update, consider placing the XWiki server in a DMZ to prevent access to internal resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5c | [email protected] | Source CodeVendor |
| https://github.com/xwiki-contrib/macro-plantuml/security/advisories/GHSA-42fc-7w97-8vrc | [email protected] | AdvisoryRemedyVendor |
| https://jira.xwiki.org/browse/PLANTUML-25 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| org.xwiki.contrib.plantuml.macro-plantuml | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | New CVE Received | [email protected] |