Attack Chain

1. An attacker identifies a vulnerable XWiki instance with an exposed /wikis/{wikiName} REST endpoint.
2. The attacker crafts a malicious XAR file containing payloads to create or modify documents.
3. The attacker sends an HTTP POST request to the /wikis/{wikiName} endpoint, including the malicious XAR file in the request body.
4. The XWiki instance processes the request without authentication or authorization.
5. The XAR file is imported, leading to the creation or modification of documents within the specified wiki.
6. The attacker gains unauthorized access to the modified documents.
7. The attacker leverages the modified documents to execute arbitrary code or manipulate data within the XWiki instance.

Impact

Successful exploitation of CVE-2026-33137 allows unauthenticated attackers to create, modify, or delete content within the XWiki platform. This can lead to complete compromise of the XWiki instance, including unauthorized data access, data manipulation, and potentially arbitrary code execution on the server. The impact is significant, particularly for organizations relying on XWiki for critical knowledge management and collaboration.

Recommendation

• Upgrade XWiki installations to patched versions: 16.10.17, 17.4.9, 17.10.3, 18.0.1, or 18.1.0-rc-1 to address CVE-2026-33137.
• Implement an HTTP proxy rule to block POST requests to the /wikis/{wikiName} endpoint as a temporary workaround.
• Deploy the Sigma rule "Detect XWiki Unauthenticated XAR Import via REST API" to identify exploitation attempts in web server logs.
• Monitor web server logs for suspicious POST requests to the /wikis/{wikiName} endpoint.