VYPR
High severityNVD Advisory· Published Apr 29, 2025· Updated Apr 29, 2025

YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution

CVE-2025-46347

Description

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a file with a PHP extension, which then can be browsed to in order to execute arbitrary code on the server, resulting in a full compromise of the server. This could potentially be performed unwittingly by a user. This issue has been patched in version 4.5.4.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
yeswiki/yeswikiPackagist
< 4.5.44.5.4

Affected products

1

Patches

1
8fe5275a78dc

fix(templates): css preset should end with .css extension

https://github.com/YesWiki/yeswikiFlorian SchmittApr 16, 2025via ghsa
1 file changed · +4 0
  • tools/templates/controllers/ApiController.php+4 0 modified
    @@ -27,6 +27,10 @@ public function deleteCustomCSSPreset($presetFilename)
          */
         public function addCustomCSSPreset($presetFilename)
         {
    +        $fileParts = pathinfo($presetFilename);
    +        if (strtolower($fileParts['extension']) !== 'css') {
    +            return new ApiResponse(['code' => 400, 'message' => 'Wrong filename extension, should be .css'], 400);
    +        }
             $result = $this->getService(ThemeManager::class)->addCustomCSSPreset($presetFilename, $_POST);
             $code = ($result['status'])
                 ? 200 // 'OK'
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.