The PlantUML Macro on XWiki renders UML diagrams by contacting an external PlantUML server. The 'server' parameter is accepted without validation, allowing an attacker to supply a URL that resolves to an internal IP or a malicious endpoint. When the XWiki server attempts to contact this address it can reach otherwise inaccessible resources or execute network‑based attacks. This flaw is classified as CWE‑918 and enables the attacker to exploit internal services or exfiltrate data, thereby affecting confidentiality and integrity of the system.

The vulnerability exists in the xwiki‑contrib macro‑plantuml component used within XWiki. All releases prior to version 2.4.1 are affected. No further version details are provided by the CNA, so any deployment of macro‑plantuml older than 2.4.1 is susceptible.

The CVSS score of 4.4 indicates a moderate severity. Exploitation requires only that an attacker supply a malicious macro in a page or through the API; privileged access is not needed. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, suggesting lower current exploitation probability. Nevertheless, the attacker could pivot to internal resources or use the connection to reach external networks, a capability that is valuable for advanced threat actors. The likely attack vector is user‑provided macro content, as inferred from the description.