CVE-2026-33137CWE-862

XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

Critical · published May 20, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00879 · 58.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-20T18:59Z
EPSS history
Timeline
  • 20 MAY 18:59Z
    XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
    cvelistv5