CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki
Attackers can read arbitrary files on the server via path traversal in the squelette parameter of YesWiki.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31131?
CVE-2025-31131 is a high-severity path traversal vulnerability in yeswiki, published on 1 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
Weakness: CWE-22
Which versions are affected by CVE-2025-31131?
2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.5.2 |
yeswiki/yeswiki Packagist | All versions | 4.5.2 |
Products include Yeswiki Yeswiki.
How do I fix CVE-2025-31131?
Upgrade yeswiki/yeswiki to 4.5.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-31131 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-31131 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in yeswiki
- CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
- CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
- CVE-2018-1000641 Deserialization in n/a
- CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-24017 YesWiki Vulnerable to Unauthenticated DOM Based XSS
Sources
Also known as GHSA-w34w-fvp3-68xm.