CVE-2026-33137: XWiki Platform missing authorization in XAR import API

Overview

XWiki Platform is a generic wiki platform that provides runtime services for applications built on it. According to the record, the POST /wikis/{wikiName} API performs a XAR import without authentication or authorization checks. The weakness is classified as CWE-862 (Missing Authorization).

Impact

• An unauthenticated remote attacker could create or update documents in the targeted wiki.
• The CVSS 4.0 vector in the record rates confidentiality, integrity and availability impact on the vulnerable system as High, with no user interaction and no privileges required.
• The record's score of 9.3 was provided by GitHub Security Advisories. No other scoring provider is listed.

Affected products and versions

• Product: XWiki Platform.
• The record describes the affected range as starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9 and 16.10.17.
• Patched releases named in the record: 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.
• The structured affected and fixes fields in the record are empty, so the exact boundaries of each release branch should be confirmed in the advisory.

Exploitation status

• The record marks this CVE as not listed in the CISA KEV catalog, so active exploitation is not confirmed by the sources consulted.
• The EPSS probability is 0.00879 with a percentile of 0.58006, as recorded for the date 2026-10-13. EPSS estimates likelihood of exploitation and does not confirm exploitation.

Remediation and mitigation

• Upgrade XWiki Platform to one of the patched releases that match your branch: 16.10.17, 17.4.9, 17.10.3, 18.0.1 or 18.1.0-rc-1.
• If an immediate upgrade is not possible, restrict network access to the wiki's management and API endpoints to trusted networks and place authentication controls in front of them where feasible.
• After patching, review whether any unexpected documents or content were created or changed.

Detection guidance

• Review web server and application logs for POST requests to wiki management endpoints that were not preceded by an authenticated session.
• Look for unexpected XAR import activity and for document creations or modifications that do not match known editorial workflows.
• Compare document version history and page metadata against backups to identify unauthorized changes.

Limitations of the available information

• The record does not include a structured list of affected version ranges, and the fixes field is empty; the patched versions are taken from the description.
• The description does not state whether the 18.0.x branch is affected before 18.0.1; this is unknown from the record.
• The record does not state whether XAR import can be disabled by configuration as a mitigation; this is unknown.
• The record does not describe public proof-of-concept code or in-the-wild campaigns; the sources consulted do not confirm them.
• The title field in the record is empty and the source status is Deferred.

Frequently asked questions

What does CVE-2026-33137 allow an attacker to do?

According to the record, an unauthenticated attacker can use the POST /wikis/{wikiName} API, which performs a XAR import without authorization checks, to create or update documents in the target wiki.

Which XWiki versions are patched?

The record lists patched releases 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1. Administrators should upgrade to the release matching their branch.

Is this vulnerability known to be actively exploited?

No. The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.