CVE-2026-33137: XWiki Platform missing authorization in REST API XAR import

CVE-2026-33137 · Severity: critical · CVSS 4 · Published 2026-05-20

XWiki, a popular open-source collaborative platform, contains a security flaw that allows anyone on the network to modify or create documents without logging in. An attacker could use this to deface the wiki, inject malicious content, or overwrite critical business information. This poses a significant risk to data integrity and the overall trustworthiness of the platform.

Technologies: org.xwiki.platform:xwiki-platform-rest-server (Maven), Xwiki Platform. Vendors: Maven, Xwiki.

Quick answers

Is CVE-2026-33137 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33137 being exploited in the wild.
How severe is CVE-2026-33137?
Critical severity, with a CVSS score of 4, published 20 May 2026.
Which products and versions are affected?
org.xwiki.platform:xwiki-platform-rest-server (Maven) ECOSYSTEM:introduced=15.10.6,fixed=16.10.17; Xwiki Platform < 16.10.17, < 17.4.9, < 17.10.3, < 18.0.1, < 18.1.0-rc-1; XWiki Platform >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1.
Is there a fix for CVE-2026-33137?
Yes. org.xwiki.platform:xwiki-platform-rest-server (Maven): upgrade to 16.10.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33137 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-33137?
Check whether you run org.xwiki.platform:xwiki-platform-rest-server (Maven), Xwiki Platform or XWiki Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.xwiki.platform:xwiki-platform-rest-server (Maven): upgrade to 16.10.17 or later
    # set org.xwiki.platform:xwiki-platform-rest-server to 16.10.17 in your pom.xml or build.gradle

Technical details

A missing authorization vulnerability (CWE-862) exists in the XWiki REST API endpoint `POST /wikis/{wikiName}`. The endpoint fails to perform authentication or authorization checks before executing a XAR (XWiki Archive) import. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request to the affected endpoint, allowing them to create new documents or update existing ones within the target wiki. The vulnerability has been patched in versions 16.10.17, 17.4.9, 17.10.3, 18.0.1, and 18.1.0-rc-1.

Affected products

  • XWiki XWiki Platform >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1

Identifiers

  • CVE-2026-33137
  • GHSA-qrvh-r3f2-9h4r

Timeline

  • 2026-05-20: advisory: NVD publication date
  • 2026-05-26: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.