CVE-2026-33229Critical· 9.8▾ AbyssalPoC availableXWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
1 GitHub repo
0.5% → 1.2%
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users. This vulnerability is fixed in 17.4.8 and 17.10.1.
xwiki >= 17.0.0, < 17.4.8xwiki >= 17.5.0, < 17.10.1Upgrade past the affected range:
xwiki 17.10.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-55748High· 7.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
CVE-2025-55749High· 7.5XWiki is an open-source wiki software platform
CVE-2025-66472Medium· 6.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
CVE-2025-58049Medium· 5.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
CVE-2025-66473High· 7.5XWiki is an open-source wiki software platform
CVE-2025-65036High· 8.3XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence