CVE-2025-34111 Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE

What is CVE-2025-34111?

CVE-2025-34111 is a critical vulnerability in Tiki Tikiwiki Cms\/Groupware, published on 15 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.

Weakness: CWE-434, CWE-306, CWE-20

Which versions are affected by CVE-2025-34111?

It affects 1 product.

Products include Tiki Tikiwiki Cms\/Groupware.

How do I fix CVE-2025-34111?

No fix has been published for CVE-2025-34111 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-34111 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34111 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in Tiki Tikiwiki Cms\/Groupware

• CVE-2008-3653 Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors. Critical 10.0
• CVE-2007-6529 Other in n/a Critical 10.0
• CVE-2010-4239 Path traversal in CMS Groupware Critical 9.8
• CVE-2012-0911 Deserialization in n/a Critical 9.8
• CVE-2020-29254 Cross-site request forgery in n/a High 8.8

All Tiki Tikiwiki Cms\/Groupware vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rjx6-82gp-m7gg.