# Xwiki vulnerabilities Source: https://junglewise.ai/threats/vendors/xwiki Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/xwiki.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in Xwiki: 0 in the last 7 days and 3 in the last 90 days, 6 of them critical and 1 exploited in the wild. The most recent, CVE-2025-53837, was published on 18 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 16 (6 critical, 1 exploited in the wild) ## About Xwiki An open-source software development organization that maintains the XWiki enterprise wiki platform. ## Latest Xwiki vulnerabilities - [CVE-2025-53837: XWiki xwiki-rendering-xml eval injection via HTML macro escaping](https://junglewise.ai/threats/cve-2025-53837-xwiki-xwiki-rendering-xml-eval-injection-via-html-macro-escaping) (critical, CVSS 9.9, published 18 Sep 2026) - [CVE-2026-53966: XWiki Platform Live Data privilege escalation through edit API](https://junglewise.ai/threats/cve-2026-53966-xwiki-platform-live-data-privilege-escalation-through-edit-api) (high, CVSS 4, published 15 Sep 2026) - [CVE-2026-34151: XWiki Platform path traversal in skin action endpoint](https://junglewise.ai/threats/cve-2026-34151-xwiki-platform-path-traversal-in-skin-action-endpoint) (high, CVSS 4, published 14 Sep 2026) - [CVE-2026-48048: XWiki Platform password hash disclosure in Livetable results](https://junglewise.ai/threats/cve-2026-48048-xwiki-platform-password-hash-disclosure-in-livetable-results) (high, CVSS 7.5, published 10 Aug 2026) - [CVE-2026-48047: XWiki Platform path traversal in WebJar API](https://junglewise.ai/threats/cve-2026-48047-xwiki-platform-path-traversal-in-webjar-api) (medium, CVSS 4, published 7 Aug 2026) - [CVE-2023-37465: XWiki Discussion Extension CSRF in message deletion endpoint](https://junglewise.ai/threats/cve-2023-37465-xwiki-discussion-extension-csrf-in-message-deletion-endpoint) (medium, CVSS 6.5, published 27 Jul 2026) - [CVE-2026-33137: XWiki Platform missing authorization in REST API XAR import](https://junglewise.ai/threats/cve-2026-33137-xwiki-platform-missing-authorization-in-rest-api-xar-import) (critical, CVSS 4, published 20 May 2026) - [CVE-2026-23734: XWiki Platform path traversal in ssx and jsx endpoints](https://junglewise.ai/threats/cve-2026-23734-xwiki-platform-path-traversal-in-ssx-and-jsx-endpoints) (critical, CVSS 4, published 20 May 2026) - [CVE-2025-51846: CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade…](https://junglewise.ai/threats/cve-2025-51846-cryptpad-2025-3-1-allows-unbounded-websocket-frame-flood-a-remote) (high, CVSS 7.5, published 30 Apr 2026) - [CVE-2026-40105: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions…](https://junglewise.ai/threats/cve-2026-40105-xwiki-has-reflected-cross-site-scripting-xss-in-page-history) (medium, CVSS 6.1, published 15 Apr 2026) - [CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability](https://junglewise.ai/threats/cve-2026-40104-xwiki-s-rest-apis-can-list-all-pages-spaces-leading-to) (high, CVSS 8.2, published 15 Apr 2026) - [CVE-2026-33229: XWiki Platform sandbox bypass in Velocity scripting API](https://junglewise.ai/threats/cve-2026-33229-xwiki-platform-sandbox-bypass-in-velocity-scripting-api) (critical, CVSS 9.8, published 8 Apr 2026) - [CVE-2025-66024: XWiki Blog Application Stored XSS in Post Title](https://junglewise.ai/threats/cve-2025-66024-xwiki-blog-application-stored-xss-in-post-title) (critical, CVSS 9, published 4 Mar 2026) - [CVE-2025-65089: XWiki view file macro: User can view content of office file without view rights on the attachment](https://junglewise.ai/threats/cve-2025-65089-xwiki-view-file-macro-user-can-view-content-of-office-file) (medium, CVSS 6.8, published 19 Nov 2025) - [CVE-2025-24893: XWiki Platform eval injection in SolrSearch](https://junglewise.ai/threats/cve-2025-24893-xwiki-platform-eval-injection-in-solrsearch) (critical, exploited in the wild, CVSS 9.8, published 30 Oct 2025) - [CVE-2025-49580: XWiki privilege escalation via link refactoring](https://junglewise.ai/threats/cve-2025-49580-xwiki-privilege-escalation-via-link-refactoring) (high, CVSS 4, published 13 Jun 2025) ## Most severe Xwiki vulnerabilities - [CVE-2025-24893: XWiki Platform eval injection in SolrSearch](https://junglewise.ai/threats/cve-2025-24893-xwiki-platform-eval-injection-in-solrsearch) (critical, exploited in the wild, CVSS 9.8, published 30 Oct 2025) - [CVE-2025-53837: XWiki xwiki-rendering-xml eval injection via HTML macro escaping](https://junglewise.ai/threats/cve-2025-53837-xwiki-xwiki-rendering-xml-eval-injection-via-html-macro-escaping) (critical, CVSS 9.9, published 18 Sep 2026) - [CVE-2026-33229: XWiki Platform sandbox bypass in Velocity scripting API](https://junglewise.ai/threats/cve-2026-33229-xwiki-platform-sandbox-bypass-in-velocity-scripting-api) (critical, CVSS 9.8, published 8 Apr 2026) - [CVE-2025-66024: XWiki Blog Application Stored XSS in Post Title](https://junglewise.ai/threats/cve-2025-66024-xwiki-blog-application-stored-xss-in-post-title) (critical, CVSS 9, published 4 Mar 2026) - [CVE-2026-23734: XWiki Platform path traversal in ssx and jsx endpoints](https://junglewise.ai/threats/cve-2026-23734-xwiki-platform-path-traversal-in-ssx-and-jsx-endpoints) (critical, CVSS 4, published 20 May 2026) - [CVE-2026-33137: XWiki Platform missing authorization in REST API XAR import](https://junglewise.ai/threats/cve-2026-33137-xwiki-platform-missing-authorization-in-rest-api-xar-import) (critical, CVSS 4, published 20 May 2026) - [CVE-2026-40104: XWiki's REST APIs can list all pages/spaces, leading to unavailability](https://junglewise.ai/threats/cve-2026-40104-xwiki-s-rest-apis-can-list-all-pages-spaces-leading-to) (high, CVSS 8.2, published 15 Apr 2026) - [CVE-2026-48048: XWiki Platform password hash disclosure in Livetable results](https://junglewise.ai/threats/cve-2026-48048-xwiki-platform-password-hash-disclosure-in-livetable-results) (high, CVSS 7.5, published 10 Aug 2026) - [CVE-2025-51846: CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade…](https://junglewise.ai/threats/cve-2025-51846-cryptpad-2025-3-1-allows-unbounded-websocket-frame-flood-a-remote) (high, CVSS 7.5, published 30 Apr 2026) - [CVE-2026-34151: XWiki Platform path traversal in skin action endpoint](https://junglewise.ai/threats/cve-2026-34151-xwiki-platform-path-traversal-in-skin-action-endpoint) (high, CVSS 4, published 14 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Xwiki technologies - [XWiki Platform](https://junglewise.ai/threats/technologies/platform): 9 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Xwiki vulnerabilities", https://junglewise.ai/threats/vendors/xwiki, 9 November 2026.