CVE-2026-33137: XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33137?
CVE-2026-33137 is considered a high severity vulnerability due to its potential for unauthorized XAR imports via the REST API.
How do I fix CVE-2026-33137?
To fix CVE-2026-33137, upgrade XWiki Platform to version 18.1.0-rc-1 or later.
Which versions of XWiki are affected by CVE-2026-33137?
CVE-2026-33137 affects XWiki Platform versions prior to 16.10.17, 17.4.9, 17.10.3, and 18.0.1.
What type of vulnerability is CVE-2026-33137?
CVE-2026-33137 is an unauthenticated XAR import vulnerability which allows attackers to exploit the REST API.
Is authentication required to exploit CVE-2026-33137?
No, CVE-2026-33137 can be exploited without authentication, making it particularly dangerous.