Auth bypass in Yeswiki
CVE-2025-46348
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.
Vulnerability class: Broken Authentication
EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Yeswiki — versions < 4.5.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-46348?
- CVE-2025-46348 is a critical-severity vulnerability in Yeswiki, classified under Improper Authentication. CVSS score: 10.0/10. Published 2025-04-29.
- How severe is CVE-2025-46348?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2025-46348 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.