# CVE-2026-42140: macro-plantuml SSRF — Fixed in 2.4.1 ☕ ☕ Maven Not in CISA KEV MEDIUM severity # CVE-2026-42140 — macro-plantuml-macro MEDIUM [Fix: xwiki-contrib/macro-plantuml@c8b19bd](https://github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5c) CVE-2026-42140 is a medium-severity (CVSS 4.4) Server-Side Request Forgery (SSRF) vulnerability in org.xwiki.contrib.plantuml:macro-plantuml-macro. A fix is available for org.xwiki.contrib.plantuml:macro-plantuml-macro — see the affected versions and patch details below. Server-Side Request Forgery (SSRF) in PlantUML Macro via 'server' parameter Also known as[GHSA-42fc-7w97-8vrc](/vulnerability/GHSA-42fc-7w97-8vrc) Published May 4, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42140. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.2%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs8th percentile — riskier than 8% of all scored CVEsHighest risk 0.00%0.24%0.49%0.73%0.0%0.2%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected ☕`org.xwiki.contrib.plantuml:macro-plantuml-macro` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems. ## Description #### Impact The [PlantUML Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/PlantUML+Macro) is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the `server` parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue affects all versions of the Plant UML Macro extension till version 2.4 included. #### Patches Version 2.4.1 of the Plant UML Macro extension fixes the issue by verifying if the supplied server domain matches one of the [trusted domain configured inside of XWiki](https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Configuration/#HTrusteddomains). #### Workarounds Protect the XWiki server by placing it in a DMZ so that it cannot access any other internal servers. #### Resources The issue was fixed in [PLANTUML-25](https://jira.xwiki.org/browse/PLANTUML-25) by the commit [c8b19bda93058794e04c8862fc7ca85c59b5fe5c](https://github.com/xwiki-contrib/macro-plantuml/commit/c8b19bda93058794e04c8862fc7ca85c59b5fe5c). #### For more information If there are any questions or comments about this advisory: - Open an issue in [JIRA XWiki.org](https://jira.xwiki.org/) - Send an email to [Security Mailing List](mailto:security@xwiki.org) #### Attribution The issue was reported by Łukasz Rybak. ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix ☕Maven `org.xwiki.contrib.plantuml:macro-plantuml-macro` all versions 2.4.1`org.xwiki.contrib.plantuml:macro-plantuml-macro:2.4.1` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.xwiki.contrib.plantuml:macro-plantuml-macro, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update org.xwiki.contrib.plantuml:macro-plantuml-macro to 2.4.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42140 is resolved across your whole dependency graph. 3. ### Workarounds Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. ## Frequently Asked Questions \### Impact The \[PlantUML Macro\](https://extensions.xwiki.org/xwiki/bin/view/Extension/PlantUML+Macro) is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the \`server\` parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram. This issue affects all versions of the Plant UML Macro extension till version 2.4 included. ### Patches Version 2.4.1 of the Plant UML O3 Security · Impact-Aware SCA ### Is CVE-2026-42140 in your dependencies? Find it across Maven, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)