PT-2025-18210 · Yeswiki · Yeswiki

Pizza-Power · Published 2025-04-29 · Updated 2025-04-30 · CVE-2025-46348

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.5.4

Description The issue allows a malicious user to create and download site backups without authentication. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. The request to commence a site backup can be performed and downloaded without authentication due to a predictable filename used for the archives.

Recommendations For versions prior to 4.5.4, update to version 4.5.4 to resolve the issue. As a temporary workaround, consider restricting access to the site backup functionality until the update is applied.

Exploit

Fix

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-287

CWE-862

Related Identifiers

CVE-2025-46348

GHSA-WC9G-6J9W-HR95

Affected Products

Yeswiki

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/46xxx/CVE-2025-46348.json · Exploit
• 🔥 https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95 · Exploit
• https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530 · Patch
• https://osv.dev/vulnerability/CVE-2025-46348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46348 · Security Note
• https://osv.dev/vulnerability/GHSA-wc9g-6j9w-hr95 · Vendor Advisory
• https://github.com/YesWiki/yeswiki · Note
• https://twitter.com/cybercronai/status/1917548343087026332 · Twitter Post
• https://t.me/cvedetector/24053 · Telegram Post
• https://t.me/latest_high_impact_cve/2223 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1917348674344038616 · Twitter Post
• https://twitter.com/CVEnew/status/1917326667728515417 · Twitter Post
• https://t.me/cvetracker/22659 · Telegram Post
• https://twitter.com/CveFindCom/status/1917323500651421844 · Twitter Post