CVE-2025-46347: YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Summary
CVE-2025-46347: YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution. Affects yeswiki/yeswiki versions < 4.5.4. Fixed in 4.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It offers features such as graphical configuration, customizable templates, and user-friendly editing tools. However, a critical vulnerability has been identified that allows unauthorized file writing and execution, potentially compromising the server's security.
Vulnerability Detail
The vulnerability arises from an arbitrary file write capability that allows users to create files with a PHP extension. This can be exploited by an attacker to write malicious PHP code to the server, which can then be executed by accessing the file via a web browser. The issue stems from insufficient validation of file extensions during the save operation, allowing for the execution of arbitrary code. The impact of this vulnerability is severe, as it can lead to full server compromise, especially if exploited by an authenticated user or through cross-site scripting (XSS) vulnerabilities.
How To Fix
Minimum fixed version
4.5.4
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable PHP execution in user-writable directories on your server. This can be done by modifying the server configuration to prevent PHP files from being executed in specific directories. For example, in an Apache server, you can add the following directive to your .htaccess file: 'php_flag engine off'.
Conclusion
The CVE-2025-46347 vulnerability in YesWiki poses a significant risk due to its potential for remote code execution. It is crucial for users to update to the latest version to mitigate this risk. Additionally, implementing workarounds can provide temporary relief while awaiting a full patch.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
CVE-2025-46347 is a vulnerability in YesWiki that allows remote code execution through arbitrary PHP file writing.
If you are using YesWiki version 4.5.3 or earlier, your installation is vulnerable. You can check your version in the application settings.
Exploitation of this vulnerability can lead to full server compromise, allowing attackers to execute arbitrary commands on the server.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Vulert uses the composer.lock file to provide real-time alerts.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
