CVE-2026-33229: XWiki Remote Code Execution Vulnerability in xwiki-platform-oldcore
Summary
CVE-2026-33229: XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API. Affects org.xwiki.platform:xwiki-platform-oldcore across 2 version ranges.
>= 17.0.0-rc-1, < 17.4.8
>= 17.5.0-rc-1, < 17.10.1
Fixed in 17.4.8 or 17.10.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XWiki is a powerful open-source platform designed for collaborative knowledge management and content creation. It allows users to create, edit, and manage content in a wiki-style environment. The xwiki-platform-oldcore package is a core component of XWiki that provides essential functionalities. However, it has been found to have a critical vulnerability that can be exploited by users with script rights, potentially leading to severe security breaches.
Vulnerability Detail
The vulnerability arises from an improperly protected Velocity scripting API within the XWiki platform. This flaw allows any user with script rights to bypass the intended sandboxing mechanisms, enabling them to execute arbitrary Python scripts. Such unauthorized access can compromise the confidentiality, integrity, and availability of the entire XWiki instance, posing significant risks to sensitive data and system operations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 17.0.0-rc-1, < 17.4.817.4.8 -
>= 17.5.0-rc-1, < 17.10.117.10.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds to mitigate this vulnerability other than exercising caution in granting script rights to users. It is advisable to limit script rights to trusted individuals only.
Conclusion
The XWiki vulnerability CVE-2026-33229 poses a significant risk due to its potential for remote code execution through an unprotected scripting API. Users are strongly advised to update to the latest patched versions of the affected packages to safeguard their systems.
See every vulnerability recorded for org.xwiki.platform:xwiki-platform-oldcore →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
The vulnerability was discovered and reported by Youssef Azefzaf.
Exploitation of this vulnerability can lead to unauthorized execution of scripts, compromising the entire XWiki instance and exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, ensure that script rights are only granted to trusted users to minimize risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.platform:xwiki-platform-oldcore.
