CVE-2025-46348 YesWiki Unauthenticated Site Backup Creation and Download Vulnerability
Summary
CVE-2025-46348: YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download. Affects yeswiki/yeswiki versions < 4.5.4. Fixed in 4.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It is designed to be user-friendly and flexible, enabling users to customize their wikis easily. However, a critical vulnerability has been identified that allows unauthenticated users to create and download site backups, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability arises from the fact that the request to initiate a site backup can be executed without any authentication. This allows malicious users to create backups and subsequently download them without needing to log in. The backup files are generated with predictable filenames, making it easy for attackers to guess and access these files. This could lead to severe consequences, including unauthorized access to sensitive site data and potential denial of service through excessive backup requests.
How To Fix
Minimum fixed version
4.5.4
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the backup functionality by implementing authentication checks in your application or by disabling the backup feature until the package is updated.
Conclusion
In summary, CVE-2025-46348 is a critical vulnerability in YesWiki that allows unauthenticated users to create and download backups, posing significant security risks. It is essential to update to the patched version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
CVE-2025-46348 is a critical vulnerability in YesWiki that allows unauthenticated users to create and download site backups, potentially exposing sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized access to sensitive site data and potential denial of service due to excessive backup requests.
You can update YesWiki to version 4.5.4 or later using Composer with the command: 'composer update yeswiki/yeswiki'.
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
