High severity8.6NVD Advisory· Published Apr 1, 2025· Updated Jun 17, 2026

CVE-2025-31131

Description

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
yeswiki/yeswikiPackagist	< 4.5.2	4.5.2

Affected products

Yeswiki/Yeswiki2 versions
cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*range: <4.5.2
- (no CPE)range: < 4.5.2
ghsa-coords
pkg:composer/yeswiki/yeswiki
Range: < 4.5.2

Patches

Vulnerability mechanics

References

github.com/YesWiki/yeswiki/commit/f78c915369a60c74ab8f38561ae93a4aaca9b989nvdPatchWEB
github.com/YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xmnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-w34w-fvp3-68xmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-31131ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.004
exploit	0.030
kev	0.000
patch	-0.070
ransomware	0.000