Medium WID-SEC-2026-1013 1 CVE

xwiki: Schwachstelle ermöglicht Codeausführung

Published Apr 8, 2026 · Updated Apr 8, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in xwiki ausnutzen, um beliebigen Programmcode auszuführen.

Product

XWiki ist eine Open-Source-Wiki-Software-Plattform, für die Erstellung und Verwaltung von Wikis und Knowledge-Management-Systemen

Vulnerabilities 1

High 8.6

CVE-2026-33229 Public exploit

XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting AP…

xwiki org.xwiki.platform xwiki-platform xwiki-platform-oldcore Maven

Apr 8, 2026

Revision history

2026-04-08 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-h259-74h5-4rh9 vom 2026-04-08
https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h259-74h5-4rh9
Xwiki Jira vom 2025-11-07 mit PoC
https://jira.xwiki.org/browse/XWIKI-23698