{"action":"Upgrade org.xwiki.platform:xwiki-platform-rest-server to 16.10.17 (16.10.x), 17.4.9 (17.4.x), 17.10.3 (17.10.x) or 18.1.0-rc-1 (18.1.x) or later.","affected":[{"fixed":"16.10.17","introduced":"15.10.6"},{"fixed":"17.4.9","introduced":"17.0.0-rc-1"},{"fixed":"17.10.3","introduced":"17.5.0"},{"fixed":"18.1.0-rc-1","introduced":"18.0.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-rest-server","cve_ids":["CVE-2026-33137"],"ecosystem":"Maven","epss":0.00594,"exploited":false,"fixed_versions":["16.10.17","17.4.9","17.10.3","18.1.0-rc-1"],"ghsa_id":"GHSA-qrvh-r3f2-9h4r","id":"tcs_01M5N9A7N4R6JCBKZ84R3AB0D9","modified_at":"2026-05-26T19:26:29.502982Z","published_at":"2026-05-26T18:58:19Z","references":["https://osv.dev/vulnerability/GHSA-qrvh-r3f2-9h4r","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-qrvh-r3f2-9h4r","https://nvd.nist.gov/vuln/detail/CVE-2026-33137","https://github.com/xwiki/xwiki-platform/commit/4b7b95b79256374d487e9ece1dc48f527966990f","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XWIKI-23953"],"severity":{"label":"critical","score":9.3},"sources":[{"source":"osv","source_id":"GHSA-qrvh-r3f2-9h4r","url":"https://osv.dev/vulnerability/GHSA-qrvh-r3f2-9h4r"},{"source":"nvd","source_id":"CVE-2026-33137","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33137"}],"summary":"XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}"}