PT-2025-14120 · Yeswiki · Yeswiki

Masquerad3R · Published 2025-04-01 · Updated 2025-06-07 · CVE-2025-31131

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.2

Description The issue concerns a path traversal vulnerability in the squelette parameter, allowing unauthorized access to server files. This enables read access to arbitrary files on the server.

Recommendations For versions prior to 4.5.2, update to version 4.5.2 to fix this security flaw. As a temporary workaround, consider restricting access to the squelette parameter to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-31131

GHSA-W34W-FVP3-68XM

Affected Products

Yeswiki

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31131.json · Exploit
• 🔥 https://github.com/B1ack4sh/Blackash-CVE-2025-31131 · Exploit
• 🔥 https://exploit-db.com/exploits/52135 · Exploit
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xm · Vendor Advisory
• https://github.com/YesWiki/yeswiki/commit/f78c915369a60c74ab8f38561ae93a4aaca9b989 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-31131 · Security Note
• https://osv.dev/vulnerability/GHSA-w34w-fvp3-68xm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-31131 · Vendor Advisory
• https://github.com/YesWiki/yeswiki · Note
• https://twitter.com/CVEnew/status/1907339916570169706 · Twitter Post
• https://t.me/secu_001/786 · Telegram Post
• https://twitter.com/CveFindCom/status/1907086274285932605 · Twitter Post
• https://twitter.com/wgujjer11/status/1908185913055719678 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1908157625096659162 · Twitter Post
• https://twitter.com/sans_isc/status/1910353386962145666 · Twitter Post