CVE-2026-33229

XWiki Platform (before versions 17.4.8 and 17.10.1) contains an improperly protected Velocity scripting API that lets any user with script right bypass the sandbox and execute code (e.g., arbitrary Python scripts), granting full access to the instance and compromising confidentiality, integrity, ...