CVE-2025-24019: YesWiki Arbitrary File Deletion Vulnerability
Summary
CVE-2025-24019: Authenticated arbitrary file deletion in YesWiki. Affects yeswiki/yeswiki versions < 4.5.0. Fixed in 4.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It provides features such as file attachments, user permissions, and a file manager for organizing resources. However, a critical vulnerability has been identified in versions up to 4.4.5, which allows authenticated users to delete arbitrary files on the server, potentially compromising the integrity of the wiki and its data.
Vulnerability Detail
The vulnerability arises from the file manager functionality within YesWiki, specifically in the fmErase() and fmDelete() methods. These methods do not properly validate or sanitize the file paths provided by users, allowing malicious actors to specify any file path on the server. This can lead to unauthorized deletion of files, including critical system files, resulting in data loss and potential denial of service. The vulnerability is particularly severe as it allows any authenticated user to exploit this flaw without restriction, leading to significant risks for the application and its users.
How To Fix
Minimum fixed version
4.5.0
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict user permissions to limit access to the file manager functionality. This can help mitigate the risk of unauthorized file deletions until a patch is applied.
Conclusion
CVE-2025-24019 represents a significant security risk for YesWiki installations, allowing authenticated users to delete arbitrary files. It is crucial for users to update to the latest version and implement recommended security practices to safeguard their data and maintain the integrity of their wiki.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
CVE-2025-24019 is a vulnerability in YesWiki that allows authenticated users to delete arbitrary files on the server due to insufficient validation in the file manager.
YesWiki versions up to and including 4.4.5 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized deletion of important files, resulting in data loss, website defacement, and potential denial of service.
Ensure you update to the patched version (4.5.0 or later) and implement additional security measures such as restricting user permissions and validating file paths.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
