CVE-2026-33137
XWiki Platform’s POST /wikis/{wikiName} API can import XAR files without any authentication or authorization checks, allowing an attacker to create or modify documents in the wiki. This flaw exists in versions 15.10.6 through 18.1.0‑rc‑1 and has been patched in newer releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
XWiki Platform versions 15.10.6 up to 18.1.0‑rc‑1 (including 16.10.16, 17.4.8, 17.10.2, etc.). Typical users are organizations that run XWiki for collaboration and knowledge management.
Real-world impact
An unauthenticated attacker can add, edit, or delete any document in the target wiki, effectively taking control of the content and potentially injecting malicious code or disrupting operations.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability requires no authentication, grants full control over the wiki’s content, and has high impact on confidentiality, integrity, and availability.
What to do about it
- 01Upgrade XWiki to version 16.10.17 or later (or 17.4.9, 17.10.3, 18.0.1, or 18.1.0‑rc‑1).
- 02Restart the XWiki service after the upgrade.
NVD-referenced vendor advisory
Timeline
- May 20, 2026 · May 20, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 25, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.