Skip to content
Threat Feed
Subscribe

Product

XWiki Platform (< 15.10.11, 16.4.1, 5.3)

1 brief RSS
critical advisory

XWiki Unauthenticated XAR Import via REST API

An unauthenticated attacker can create or update documents in the target XWiki instance by exploiting the XAR import functionality through the `/wikis/{wikiName}` REST endpoint due to missing authentication and authorization checks, as detailed in CVE-2026-33137.

PoC xwiki-platform-rest-server +1 xwiki xar unauthenticated rce cve-2026-33137
3r 3t 1c updated