An improperly protected scripting API in XWiki Platform allows an attacker who has been granted script rights to bypass the Velocity sandbox and execute arbitrary scripts such as Python on the host operating system. This grants the attacker full control over the XWiki instance, compromising confidentiality, integrity, and availability of all data and services, effectively allowing them to modify or delete any content, perform privilege escalation, or launch further attacks against the underlying infrastructure. The flaw reflects a severe access‑control issue (CWE‑862).

The vulnerability affects all XWiki Platform releases built before versions 17.4.8 and 17.10.1. The impacted products include the legacy OldCore distributions (org.xwiki.platform:xwiki-platform-legacy-oldcore and org.xwiki.platform:xwiki-platform-oldcore) as well as the standard xwiki-platform bundle. Administrators should verify that no untrusted accounts possess the script right privilege.

The CVSS score of 8.6 indicates a high severity risk. EPSS for this issue is not publicly available, and it is not listed in the CISA KEV catalog, which suggests no confirmed exploitation yet. Based on the description, the likely attack vector is an authenticated user with script rights exploiting the exposed API. Because script rights already provide a high level of access, the risk of exploitation is significant if any such accounts exist in the environment. Prompt remediation is essential to mitigate potential full compromise of the instance.