What’s Vulnerable › Vulnerabilities

CVE-2026-33137: XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-20 · updated 2026-07-23
• Weakness: CWE-862

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.

Affected products

• xwiki-platform: from 15.10.6, < 16.10.17; from 17.0.0-rc-1, < 17.4.9; from 17.5.0, < 17.10.3; from 18.0.0-rc-1, < 18.1.0-rc-1

References

• https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qrvh-r3f2-9h4r
• https://jira.xwiki.org/browse/XWIKI-23953

Get alerted when CVE-2026-33137 or the next vulnerability affects your stack