XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

{
  "id": "4e34733d131be9e36ffa0ac5b5e9f8a2e512007b47245093eb6807e7bbb3947a",
  "url": "https://osv.dev/vulnerability/CVE-2026-33137",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}",
    "summary": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform is a generic wiki platform. In versions starting with 15.10.6 and prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17, the POST /wikis/{wikiName} API executes a XAR import without performing any authentication or authorization checks, allowing an unauthenticated attacker to create or update documents in the target wiki. This vulnerability has been patched in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0-rc-1.",
    "evidence": "osv:CVE-2026-33137",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-33137",
      "aliases": [
        "CVE-2026-33137",
        "GHSA-qrvh-r3f2-9h4r"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/xwiki/xwiki-platform",
              "type": "GIT",
              "events": [
                {
                  "introduced": "150468c1e2cd64a2ad85b5053e9487943d3b9b1f"
                },
                {
                  "fixed": "65a53ce90d27245391dec10056b066e7eb3ace7d"
                },
                {
                  "introduced": "445c0831fb8cf5610eda0eb58225890cb2bece6c"
                },
                {
                  "fixed": "a0c973343dbb009ef54643526df993676b0924e3"
                },
                {
                  "introduced": "b85d21efede0f7c07c04c5ad5fb7610be0866096"
                },
                {
                  "fixed": "6e30f885a30f60a418b4457335044b3724ec7f13"
                },
                {
                  "introduced": "d611720cbb5e818a686a98a452b4bead37798b24"
                },
                {
                  "fixed": "810792740bea0e5efe5f507a4ab166cf7f75aa91"
                },
                {
                  "fixed": "4b7b95b79256374d487e9ece1dc48f527966990f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "15.10.6"
                      },
                      {
                        "fixed": "16.10.17"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "17.0.0-rc-1"
                      },
                      {
                        "fixed": "17.4.9"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "17.5.0"
                      },
                      {
                        "fixed": "17.10.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "18.0.0-rc-1"
                      },
                      {
                        "fixed": "18.1.0-rc-1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4b7b95b79256374d487e9ece1dc48f527966990f"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33137.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:25.019683327Z",
      "provider": "osv",
      "references": [
        "https://jira.xwiki.org/browse/XWIKI-23953",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33137.json",
        "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qrvh-r3f2-9h4r",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-33137",
        "https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33137.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-33137",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 491477,
  "published_at": "2026-05-20T18:59:17.819+00:00"
}