CVE-2026-33137

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33137
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33137.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-33137
Aliases
Published
2026-05-20T18:59:17.819Z
Modified
2026-06-18T03:56:35.095625057Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33137.json"
}
References

Affected packages

Git / github.com/xwiki/xwiki-platform

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
150468c1e2cd64a2ad85b5053e9487943d3b9b1f
Introduced
445c0831fb8cf5610eda0eb58225890cb2bece6c
Introduced
b85d21efede0f7c07c04c5ad5fb7610be0866096
Introduced
d611720cbb5e818a686a98a452b4bead37798b24
Fixed
65a53ce90d27245391dec10056b066e7eb3ace7d
Fixed
a0c973343dbb009ef54643526df993676b0924e3
Fixed
6e30f885a30f60a418b4457335044b3724ec7f13
Fixed
810792740bea0e5efe5f507a4ab166cf7f75aa91
Fixed
4b7b95b79256374d487e9ece1dc48f527966990f
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "15.10.6"
        },
        {
            "fixed": "16.10.17"
        },
        {
            "introduced": "17.0.0-rc-1"
        },
        {
            "fixed": "17.4.9"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.3"
        },
        {
            "introduced": "18.0.0-rc-1"
        },
        {
            "fixed": "18.1.0-rc-1"
        }
    ]
}

Affected versions

xwiki-platform-16.*
xwiki-platform-16.10.0
xwiki-platform-16.10.0-rc-1
xwiki-platform-16.10.1
xwiki-platform-16.10.10
xwiki-platform-16.10.11
xwiki-platform-16.10.12
xwiki-platform-16.10.13
xwiki-platform-16.10.14
xwiki-platform-16.10.15
xwiki-platform-16.10.16
xwiki-platform-16.10.2
xwiki-platform-16.10.3
xwiki-platform-16.10.4
xwiki-platform-16.10.5
xwiki-platform-16.10.6
xwiki-platform-16.10.7
xwiki-platform-16.10.8
xwiki-platform-16.10.9
xwiki-platform-17.*
xwiki-platform-17.10.0
xwiki-platform-17.10.0-rc-1
xwiki-platform-17.10.1
xwiki-platform-17.10.2
xwiki-platform-17.4.0
xwiki-platform-17.4.0-rc-1
xwiki-platform-17.4.2
xwiki-platform-17.4.3
xwiki-platform-17.4.4
xwiki-platform-17.4.5
xwiki-platform-17.4.6
xwiki-platform-17.4.7
xwiki-platform-17.4.8
xwiki-platform-7.*
xwiki-platform-7.3-milestone-2
xwiki-platform-7.4-milestone-1
xwiki-platform-7.4-milestone-2
xwiki-platform-8.*
xwiki-platform-8.0-milestone-1
xwiki-platform-8.0-milestone-2
xwiki-platform-8.1-milestone-1
xwiki-platform-8.1-milestone-2
xwiki-platform-8.2-milestone-1
xwiki-platform-8.2-milestone-2
xwiki-platform-8.3-milestone-1
xwiki-platform-9.*
xwiki-platform-9.9-rc-2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-33137.json"