GHSA-H259-74H5-4RH9 XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

🗓️ 08 Apr 2026 15:00:17Reported by GoogleType

osv

osv🔗 osv.dev👁 1 Views

XWiki remote code execution via unprotected Velocity scripting API with script right.

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2026-33229	8 Apr 202614:53	–	attackerkb
BDU FSTEC	The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, relates to the absence of authentication mechanisms. This allows attackers to compromise the integrity, accessibility, and confidentiality of information.	15 Apr 202600:00	–	bdu_fstec
Circl	CVE-2026-33229	8 Apr 202616:00	–	circl
CNNVD	XWiki Platform 安全漏洞	8 Apr 202600:00	–	cnnvd
CVE	CVE-2026-33229	8 Apr 202614:53	–	cve
Cvelist	CVE-2026-33229 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API	8 Apr 202614:53	–	cvelist
EUVD	EUVD-2026-20478	8 Apr 202615:00	–	euvd
Github Security Blog	XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API	8 Apr 202615:00	–	github
NVD	CVE-2026-33229	8 Apr 202616:16	–	nvd
OSV	CVE-2026-33229 XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API	8 Apr 202614:53	–	osv

Source	Link
github	www.github.com/xwiki/xwiki-platform/security/advisories/GHSA-h259-74h5-4rh9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33229
github	www.github.com/xwiki/xwiki-platform/commit/9fe84da66184c05953df9466cf3a4acd15a46e63
github	www.github.com/xwiki/xwiki-platform
jira	www.jira.xwiki.org/browse/XWIKI-23698
jira	www.jira.xwiki.org/browse/XWIKI-23702

08 Apr 2026 19:36Current

5.9Medium risk

Vulners AI Score5.9

CVSS 48.6

EPSS0.0054

remote code execution velocity scripting api script right xwiki vulnerability sandbox bypass