CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
Unauthenticated attackers can create and download site backups, exposing sensitive data and potentially causing denial of service via disk exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46348?
CVE-2025-46348 is a critical missing authorization vulnerability in yeswiki, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
Which versions are affected by CVE-2025-46348?
2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.5.4 |
yeswiki/yeswiki Packagist | All versions | 4.5.4 |
Products include Yeswiki Yeswiki.
How do I fix CVE-2025-46348?
Upgrade yeswiki/yeswiki to 4.5.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-46348 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46348 exists.
Other vulnerabilities in yeswiki
- CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
- CVE-2018-1000641 Deserialization in n/a
- CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki
- CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
- CVE-2025-24017 YesWiki Vulnerable to Unauthenticated DOM Based XSS
Sources
Also known as GHSA-wc9g-6j9w-hr95.