CVE-2026-33137 XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

What is CVE-2026-33137?

CVE-2026-33137 is a critical missing authorization vulnerability in xwiki-platform, published on 20 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.

Weakness: CWE-862

Which versions are affected by CVE-2026-33137?

8 open source packages ship an affected version, including org.xwiki.platform:xwiki-platform-rest-server.

How do I fix CVE-2026-33137?

Upgrade org.xwiki.platform:xwiki-platform-rest-server to a fixed version for your release line: 16.10.17, 17.4.9, 17.10.3 or 18.1.0-rc-1.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33137 being exploited?

There is no known exploitation of CVE-2026-33137 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qrvh-r3f2-9h4r.