CVE-2026-33229

CRITICAL

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

Title source: cna

Description

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users. This vulnerability is fixed in 17.4.8 and 17.10.1.

Exploits (1)

nomisec WORKING POC
by azefzafyoussef · poc
https://github.com/azefzafyoussef/CVE-2026-33229

References (4)

Scores

CVSS v3 9.8
EPSS 0.0006
EPSS Percentile 20.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-862
Status published
Products (9)
org.xwiki.platform/xwiki-platform-legacy-oldcore 17.0.0-rc-1 - 17.4.8Maven
org.xwiki.platform/xwiki-platform-legacy-oldcore >= 17.0.0-rc-1, < 17.4.8
org.xwiki.platform/xwiki-platform-legacy-oldcore >= 17.5.0-rc-1, < 17.10.1
org.xwiki.platform/xwiki-platform-oldcore 17.0.0-rc-1 - 17.4.8Maven
org.xwiki.platform/xwiki-platform-oldcore >= 17.0.0-rc-1, < 17.4.8
org.xwiki.platform/xwiki-platform-oldcore >= 17.5.0-rc-1, < 17.10.1
xwiki/xwiki 17.0.0 - 17.4.8
xwiki/xwiki-platform >= 17.0.0-rc-1, < 17.4.8
xwiki/xwiki-platform >= 17.5.0-rc-1, < 17.10.1
Published Apr 08, 2026
Tracked Since Apr 08, 2026