YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NYeswiki
APPYeswiki< 4.5.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
Related vulnerabilities
CVE-2025-46348CRITICAL10.0PL ✓same product
YesWiki — pominięcie uwierzytelnienia przy tworzeniu i pobieraniu kopii zapasowej
CVE-2024-51478CRITICAL9.9PL ✓same product
YesWiki: słaby algorytm kryptograficzny umożliwia reset hasła dowolnego konta
CVE-2018-1000641CRITICAL9.8PL ✓same product
PHP Object Injection w YesWiki — niezaufane dane w unserialize()
CVE-2026-34598HIGH7.1same product
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists i...
CVE-2025-46349HIGH7.6same product
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the...