Skip to content
Threat Feed
Subscribe

Tag

Xar

1 brief RSS
critical advisory

XWiki Unauthenticated XAR Import via REST API

An unauthenticated attacker can create or update documents in the target XWiki instance by exploiting the XAR import functionality through the `/wikis/{wikiName}` REST endpoint due to missing authentication and authorization checks, as detailed in CVE-2026-33137.

PoC xwiki-platform-rest-server xwiki xar unauthenticated rce cve-2026-33137
2r 1t 1c updated