The vulnerability lies in XWiki Platform's REST API endpoint /wikis/{wikiName}. In affected releases, the POST method performs a XAR import without performing authentication or authorization checks. This allows an attacker who can reach the API to upload a XAR package and create or overwrite arbitrary wiki pages. By doing so the attacker can alter the content, delete or replace pages, or inject malicious configuration files, undermining the integrity of the wiki and potentially enabling further attacks.

The issue affects XWiki Platform versions prior to 18.1.0‑rc‑1, 17.10.3, 17.4.9, and 16.10.17. The fix was implemented in 16.10.17, 17.4.9, 17.10.3, 18.0.1 and 18.1.0‑rc‑1. The affected product is the XWiki Platform, a generic wiki platform used for building applications.

The vulnerability is classified as Critical with a CVSS score of 9.3, reflecting high impact and absence of required privileges. Because the EPSS score is not disclosed, the likelihood of exploitation is uncertain but the lack of authentication makes it a severe risk. The vulnerability is not listed in CISA KEV, yet it can be exploited over the network by sending a crafted POST request to the REST endpoint. The likely attack vector is a network-based POST request to /wikis/{wikiName} without any authentication.