CVE-2025-46347 json
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
published 2025-04-29 18 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-12614 , GHSA-88xg-v53p-fpvf
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.05% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-88xg-v53p-fpvf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P |
| CNA | 4.0 | 5.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | yeswiki/yeswiki | <4.5.4 |
4.5.4 |
Affected products
- YesWiki yeswiki
Classification
- Weakness
-
- CWE-116 Improper Encoding or Escaping of Output
References
-
github.com
/YesWiki/yeswiki/commit/8fe5275a78dc7e0f9c242baa3cbac6b5ac1cc066
web, patch
-
github.com
/YesWiki/yeswiki/security/advisories/GHSA-88xg-v53p-fpvf
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-46347
advisory
-
github.com
/YesWiki/yeswiki
package
Sources
- CVE List CVE-2025-46347
- GitHub Advisory GHSA-88xg-v53p-fpvf
- NVD CVE-2025-46347
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.