CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

High 7.6 Published 29 Apr 2025 Updated 29 Apr 2025

Unauthenticated attackers can execute arbitrary scripts via reflected XSS in the file upload form, potentially compromising user accounts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-46349?

CVE-2025-46349 is a high-severity cross-site scripting vulnerability in yeswiki, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

Weakness: CWE-79

Which versions are affected by CVE-2025-46349?

2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.

Package	Affected	Fixed in
`yeswiki/yeswiki` Packagist	All versions to `4.5.3`	None
`yeswiki/yeswiki` Packagist	All versions to `4.5.3`	None

Products include Yeswiki Yeswiki.

How do I fix CVE-2025-46349?

No fix has been published for CVE-2025-46349 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-46349 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-46349 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-2f8p-qqx2-gwr2.