Executive brief
XWiki, a popular open-source collaborative platform, contains a security flaw that allows anyone on the network to modify or create documents without logging in. An attacker could use this to deface the wiki, inject malicious content, or overwrite critical business information. This poses a significant risk to data integrity and the overall trustworthiness of the platform.
Technical details
A missing authorization vulnerability (CWE-862) exists in the XWiki REST API endpoint `POST /wikis/{wikiName}`. The endpoint fails to perform authentication or authorization checks before executing a XAR (XWiki Archive) import. An unauthenticated remote attacker can exploit this by sending a specially crafted POST request to the affected endpoint, allowing them to create new documents or update existing ones within the target wiki. The vulnerability has been patched in versions 16.10.17, 17.4.9, 17.10.3, 18.0.1, and 18.1.0-rc-1.
Affected products
- XWiki XWiki Platform >= 15.10.6, < 16.10.17; >= 17.0.0-rc-1, < 17.4.9; >= 17.5.0, < 17.10.3; >= 18.0.0-rc-1, < 18.1.0-rc-1
Timeline
- 2026-05-20: advisory: NVD publication date
- 2026-05-26: disclosed: GitHub Advisory published