PT-2026-31324 · Xwiki · Xwiki Platform

Azefzafyoussef · Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-33229

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 17.4.8 and prior to 17.10.1

Description The XWiki Platform has an improperly protected scripting API. A user with script rights can bypass the Velocity scripting API sandbox and execute arbitrary Python scripts, potentially gaining full access to the XWiki instance, compromising its confidentiality, integrity, and availability.

Recommendations Update to XWiki Platform version 17.4.8 or later. Update to XWiki Platform version 17.10.1 or later.

Fix

RCE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-05293

CVE-2026-33229

GHSA-H259-74H5-4RH9

Affected Products

Xwiki Platform

References · 13

• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h259-74h5-4rh9 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform/commit/9fe84da66184c05953df9466cf3a4acd15a46e63 · Patch
• https://jira.xwiki.org/browse/XWIKI-23702 · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-23698 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h259-74h5-4rh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33229 · Security Note
• https://bdu.fstec.ru/vul/2026-05293 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://twitter.com/CVEnew/status/2041975642078519517 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041977247028969916 · Twitter Post
• https://t.me/CVEtracker/50074 · Telegram Post
• https://jira.xwiki.org/secure/attachment/44323/Exploit_Velocity_Macro.webm · Note
• https://twitter.com/ptdbugs/status/2041961442421641547 · Twitter Post