Which versions of Python are affected by EUVD-2026-20478?

XWiki Platform versions 17.x prior to 17.4.8 and 17.10.1 contain a privilege escalation vulnerability that allows users with scripting permissions to execute arbitrary Python code and gain full…. A patch is available.

Python EUVD-2026-20478

Q: What is the CVSS score of EUVD-2026-20478?

EUVD-2026-20478 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

Q: How to fix or mitigate EUVD-2026-20478?

Within 24 hours: Identify all XWiki Platform 17.x deployments and document current versions; restrict script-execution permissions to only trusted administrative users pending patch deployment. Within 7 days: Apply vendor patch to XWiki Platform oldcore and legacy-oldcore components-upgrade to version 17.4.8 or 17.10.1 or later, following vendor release notes. Within 30 days: Audit logs for any script execution activity during the window before patching and review user script permissions to enforce least-privilege access.

| CVE-2026-33229 HIGH

Missing Authorization (CWE-862)

2026-04-08 https://github.com/xwiki/xwiki-platform

GHSA-h259-74h5-4rh9

Authentication Bypass Python

8.6

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 15:16 euvd

EUVD-2026-20478

Analysis Generated

Apr 08, 2026 - 15:16 vuln.today

Patch released

Apr 08, 2026 - 15:16 nvd

Patch available

CVE Published

Apr 08, 2026 - 15:00 nvd

HIGH 8.6

DescriptionGitHub Advisory

Impact

An improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users.

Patches

The vulnerability has been patched in XWiki 17.4.8 and 17.10.1 by requiring programming right to access the affected scripting API.

Workarounds

We're not aware of any workarounds except for being careful whom you grant script right.

Attribution

We thank Youssef Azefzaf for discovering and reporting this vulnerability.

AnalysisAI

Privilege escalation in XWiki Platform 17.x allows users with script rights to execute arbitrary Python code via an improperly protected scripting API, bypassing Velocity sandbox protections and gaining full system access. This affects XWiki Platform oldcore and legacy-oldcore components prior to versions 17.4.8 and 17.10.1. While requiring existing script-level privileges, the vulnerability enables complete compromise of confidentiality, integrity, and availability. Vendor-released patch available; no public exploit identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization) in XWiki Platform's Velocity scripting API implementation. XWiki uses Apache Velocity as a templating engine with sandboxing to restrict script capabilities. The affected components (xwiki-platform-oldcore and xwiki-platform-legacy-oldcore Maven packages) exposed a scripting API that failed to enforce programming right requirements, allowing users with only script right to break out of the Velocity sandbox. This enables execution of arbitrary Python scripts within the XWiki runtime environment, effectively escalating from sandboxed script execution to full programming-level access. The vulnerability represents an authorization bypass where the system failed to verify that callers of sensitive API methods possessed appropriate elevated privileges beyond basic script rights.

RemediationAI

Upgrade XWiki Platform to version 17.4.8 (for 17.4.x branch users) or 17.10.1 (for 17.10.x branch users) immediately. The vendor-released patches enforce programming right requirements on the affected scripting API, preventing script-right-only users from accessing sandbox escape functionality. The fix is implemented in commit 9fe84da66184c05953df9466cf3a4acd15a46e63 available at https://github.com/xwiki/xwiki-platform/commit/9fe84da66184c05953df9466cf3a4acd15a46e63. No workarounds are available beyond administrative controls: conduct an immediate audit of all users granted script rights and revoke privileges from any semi-trusted or untrusted accounts until patching is complete. Organizations unable to patch immediately should implement compensating controls by temporarily restricting script right assignments to only essential, fully trusted administrative personnel.