CVE-2025-34111

Katalog CVE

CVSS 9.8 · Critical EPSS 2,4%

Kerentanan Improper Input Validation pada tikiwiki cms/groupware. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.

Rincian

Terbit di NVD

15 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-306: Missing Authentication for Critical Function
CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/tikiwiki_upl... exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/40091 exploit · advisory pihak ketiga · vdb entry
• https://www.vulncheck.com/advisories/tiki-wiki-el-finder-unauthenticated-file-upload-rce advisory pihak ketiga
• https://tiki.org/article434-Security-update-Tiki-15-2-Tiki-14-4-and-Tiki-12-9-released release notes