CVE-2025-24017: YesWiki Unauthenticated DOM Based XSS Vulnerability
Summary
CVE-2025-24017: Unauthenticated DOM Based XSS in YesWiki. Affects yeswiki/yeswiki versions < 4.5.0. Fixed in 4.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It features a user-friendly interface, customizable templates, and supports tagging for easy content organization. However, versions up to 4.4.5 are vulnerable to a DOM-based Cross-Site Scripting (XSS) attack, which can be exploited by malicious users.
Vulnerability Detail
The vulnerability arises from the improper sanitization of user-controlled input when handling non-existent tags in the search feature. When a user clicks on a crafted link containing a malicious tag, it triggers client-side JavaScript execution, leading to potential account takeover and unauthorized access to sensitive user data. This vulnerability affects the integrity, availability, and confidentiality of YesWiki instances.
How To Fix
Minimum fixed version
4.5.0
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the search by tag feature until the software is updated. Additionally, implement a strong Content Security Policy (CSP) to mitigate the risk of XSS attacks.
Conclusion
The unauthenticated DOM-based XSS vulnerability in YesWiki versions up to 4.4.5 poses significant risks to user accounts and data integrity. It is crucial to update to the latest version and implement proper sanitization measures to mitigate these risks.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript in the context of a user's session, potentially leading to account takeover and unauthorized access to sensitive information.
If you are using YesWiki version 4.4.5 or earlier, your instance is vulnerable. You can check your version in the admin panel or by inspecting the source code.
If an immediate update is not possible, consider implementing a Content Security Policy and avoid using the vulnerable features until a patch is applied.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires only the composer.lock file for real-time alerts.
The CVSS score for this vulnerability is 7.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
