CVE-2026-33137
Last modified
CVE-2026-33137 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-33137?
How severe is CVE-2026-33137?
How do I fix CVE-2026-33137?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33131H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2…9.1
- CVE-2026-33132ZITADEL is an open source identity management platform. Vers…5.3
- CVE-2026-33133WeGIA is a web manager for charitable institutions. In versi…7.2
- CVE-2026-33134WeGIA is a web manager for charitable institutions. Versions…8.8
- CVE-2026-33135WeGIA is a web manager for charitable institutions. Versions…6.1
- CVE-2026-33136WeGIA is a web manager for charitable institutions. Versions…6.1
- CVE-2026-33139PySpector is a static analysis security testing (SAST) Frame…7.8
- CVE-2026-3314Missing password field masking vulnerability in Hitachi Ops …4.6
- CVE-2026-33140PySpector is a static analysis security testing (SAST) Frame…6.1
- CVE-2026-33141Chamilo LMS is a learning management system. Prior to 2.0.0-…6.5
- CVE-2026-33142OneUptime is a solution for monitoring and managing online s…8.1
- CVE-2026-33143OneUptime is a solution for monitoring and managing online s…7.5
Are you affected by CVE-2026-33137?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST