CVE-2026-33229

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33229
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33229.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33229
Aliases
Published
2026-04-08T14:53:35.977Z
Modified
2026-07-08T08:06:24.522674918Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API
Details

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users. This vulnerability is fixed in 17.4.8 and 17.10.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33229.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/xwiki/xwiki-commons

Affected ranges

Type
GIT
Repo
https://github.com/xwiki/xwiki-commons
Events
Introduced
e84d9bd1b4c0c8219597e10acfd8fbd692416294
Fixed
7ea92428b2dcec895366796ea6d211c01044257f
Introduced
0f12307c8803e5abd5fe7016bd0adf0850c5f903
Fixed
7b786a82160aed48172815cc1b7a66d46f7e5cc9
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/xwiki/xwiki-platform
Events
Introduced
7edb5b7d98170ec081c7e30237971d7dfb8a4401
Fixed
617c215853ac7649119d019d085e739f5b2b89a8
Introduced
b85d21efede0f7c07c04c5ad5fb7610be0866096
Fixed
a44c0b52377470cd7b597f0e920cfbc85cf043e1
Fixed
9fe84da66184c05953df9466cf3a4acd15a46e63
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "17.0.0"
        },
        {
            "fixed": "17.4.8"
        },
        {
            "introduced": "17.5.0"
        },
        {
            "fixed": "17.10.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33229.json"