The vulnerability resides in the POST "/wikis/{wikiName}" REST API of XWiki Platform. In versions starting with 15.10.6 and prior to 18.1.0‑rc‑1, 17.10.3, 17.4.9, and 16.10.17, the API performs a XAR import without any authentication or authorization checks, enabling an unauthenticated attacker to create or update documents in the target wiki. As a result, the attacker can inject, delete, or overwrite arbitrary wiki pages, compromising content integrity and potentially aiding further exploitation. The issue has been fixed in XWiki 16.10.17, 17.4.9, 17.10.3, 18.0.1, and 18.1.0‑rc‑1.

The issue affects XWiki Platform versions prior to 18.1.0‑rc‑1, 17.10.3, 17.4.9, and 16.10.17. The fix was implemented in 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0‑rc‑1. The affected product is the XWiki Platform, a generic wiki platform used for building applications.

The CVSS score of 9.3 categorizes this flaw as Critical, highlighting its severe potential impact. The EPSS score is reported as less than 1% (approximately 0.00016), indicating a very low exploitation probability, although the lack of authentication checks makes it a high‑impact vulnerability once discovered. This entry is not listed in the CISA KEV catalog. The flaw can be triggered over the network by supplying a crafted POST request to the /wikis/{wikiName} REST endpoint. The likely attack vector is a direct network POST request with a malicious XAR payload, requiring no credentials.