{"id":"CVE-2025-32461","aliases":["EUVD-2025-10417","GHSA-v676-fw8h-j3j9"],"status":"published","title":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3...","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00939,"percentile":0.61152,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2025-04-09T00:00:00Z","modified":"2026-10-28T02:30:37Z","products":[{"vendor":"tiki","product":"tiki"}],"references":[{"url":"https://tiki.org/article517","tags":["web"]},{"url":"https://tiki.org/article518","tags":["web"]},{"url":"https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358","tags":["fix"]},{"url":"https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1","tags":["fix"]},{"url":"https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0","tags":["fix"]},{"url":"https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a","tags":["fix"]},{"url":"https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc","tags":["fix"]},{"url":"http://seclists.org/fulldisclosure/2025/Jul/11","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32461","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v676-fw8h-j3j9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32461.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-32461","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2025-11-03T19:53:30.985Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:32:46.109993Z"}],"euvd":[{"id":"EUVD-2025-10417","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2025-11-03T19:53:30Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-v676-fw8h-j3j9","title":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3...","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","status":"published","published":"2025-04-09T04:18:20Z","modified":"2025-11-03T21:34:34Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:04:24.938946Z"}],"nvd":[{"id":"CVE-2025-32461","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","status":"published","published":"2025-04-09T02:15:16.253Z","modified":"2026-06-17T09:12:01.903Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:11:00.087098Z"}],"osv":[{"id":"CVE-2025-32461","description":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","status":"published","published":"2025-04-09T00:00:00Z","modified":"2026-10-28T02:30:37.975138102Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:44:48.02508Z"}]}}