---
id: CVE-2026-33229
title: >-
  XWiki Platform is a generic wiki platform offering runtime services for
  applications built on top of it
summary: >-
  XWiki Platform is a generic wiki platform offering runtime services for
  applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly
  protected scripting API allows any user with script right to bypass the
  sandboxing of the…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-862
vendor: xwiki
product: xwiki
affected:
  - 'xwiki >= 17.0.0, < 17.4.8'
  - 'xwiki >= 17.5.0, < 17.10.1'
patched:
  - xwiki 17.10.1
published: '2026-04-08'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-33229'
references:
  - url: >-
      https://github.com/xwiki/xwiki-platform/commit/9fe84da66184c05953df9466cf3a4acd15a46e63
    label: security-advisories@github.com
  - url: >-
      https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-h259-74h5-4rh9
    label: security-advisories@github.com
  - url: 'https://jira.xwiki.org/browse/XWIKI-23698'
    label: security-advisories@github.com
  - url: 'https://jira.xwiki.org/browse/XWIKI-23702'
    label: security-advisories@github.com
tags:
  - nvd
  - exploit-available
epss: 0.0054
epssPercentile: 0.44387
ingestedAt: '2026-07-25T23:05:59.260Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/azefzafyoussef/CVE-2026-33229'
  checkedAt: '2026-09-24T07:53:02.328Z'
exploitAvailable: true
---

## Overview

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users. This vulnerability is fixed in 17.4.8 and 17.10.1.

## Affected

- `xwiki >= 17.0.0, < 17.4.8`
- `xwiki >= 17.5.0, < 17.10.1`

## Remediation

Upgrade past the affected range:

- `xwiki 17.10.1`