CVE-2025-46349 json
YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
published 2025-04-29 18 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-12615 , GHSA-2f8p-qqx2-gwr2
- cvss
- 7.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
Patch / fix
- yeswiki yeswiki 4.5.4
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template YesWiki Reflected XSS via File Upload nuclei detection template
- github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L |
| GitHub | 3.1 | 7.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | yeswiki/yeswiki | <=4.5.3 |
no fix listed |
Affected products
- YesWiki yeswiki
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524
web, patch
-
github.com
/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206
web
-
github.com
/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-46349
advisory
-
github.com
/YesWiki/yeswiki
package
-
github.com
/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735
web
Sources
- CVE List CVE-2025-46349
- GitHub Advisory GHSA-2f8p-qqx2-gwr2
- NVD CVE-2025-46349
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.