CVE-2025-46346 YesWiki Vulnerable to Stored XSS in Comments
Attackers can inject JavaScript into YesWiki comments, executing code in victims' browsers due to insufficient input sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-46346?
CVE-2025-46346 is a medium-severity cross-site scripting vulnerability in yeswiki, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user viewing the affected comment. The XSS occurs because the application fails to properly sanitize or encode user input submitted to the comments. Notably, the application sanitizes or does not allow execution of `<script>` tags, but does not account for payloads obfuscated using JavaScript block comments like `/* JavaScriptPayload */`. This issue has been patched in version 4.5.4.
Weakness: CWE-79
Which versions are affected by CVE-2025-46346?
2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.5.4 |
yeswiki/yeswiki Packagist | All versions | 4.5.4 |
Products include Yeswiki Yeswiki.
How do I fix CVE-2025-46346?
Upgrade yeswiki/yeswiki to 4.5.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-46346 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46346 exists.
Other vulnerabilities in yeswiki
- CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
- CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
- CVE-2018-1000641 Deserialization in n/a
- CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki
- CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Sources
Also known as GHSA-59x8-cvxh-3mm4.