PT-2026-42223 · Xwiki · Xwiki Platform

Odgrso · Published 2026-01-27 · Updated 2026-05-26 · CVE-2026-33137

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions prior to 16.10.17 XWiki Platform versions prior to 17.4.9 XWiki Platform versions prior to 17.10.3 XWiki Platform versions prior to 18.1.0-rc-1

Description The 'POST /wikis/{wikiName}' API executes a XAR import without performing authentication or authorization checks. This allows an unauthenticated attacker to create or update documents in the target wiki. XAR is a format used by XWiki to export and import content.

Recommendations Update to version 16.10.17. Update to version 17.4.9. Update to version 17.10.3. Update to version 18.0.1 or 18.1.0-rc-1.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-07302

CVE-2026-33137

GHSA-QRVH-R3F2-9H4R

Affected Products

Xwiki Platform

References · 11

• 🔥 https://github.com/portbuster1337/CVE-2026-33137 · Exploit
• https://osv.dev/vulnerability/GHSA-qrvh-r3f2-9h4r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33137 · Security Note
• https://bdu.fstec.ru/vul/2026-07302 · Security Note
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qrvh-r3f2-9h4r · Note
• https://jira.xwiki.org/browse/XWIKI-23953 · Note
• https://t.me/CVEtracker/54415 · Telegram Post
• https://twitter.com/autumn_good_35/status/2057488273904455978 · Twitter Post
• https://twitter.com/ptdbugs/status/2059189150452981998 · Twitter Post