Vulnerability details
CVE-2025-34111
Tiki Software Community Association Wiki CMS Groupware
Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
CVSS 4.0
9.3Critical
Official description
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Tiki Software Community Association | Wiki CMS Groupware | v ≤ 15.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://tiki.org/article434-Security-update-Tiki-15-2-Tiki-14-4-and-Tiki-12-9-released vendor-advisorypatch
- https://www.exploit-db.com/exploits/40091 exploit
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/tikiwiki_upload_exec.rb exploit
- https://www.vulncheck.com/advisories/tiki-wiki-el-finder-unauthenticated-file-upload-rce third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-07-15
- Last updated
- 2026-05-15
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
2.57%
Probability of exploitation in 30 days
85.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type
- CWE-306Missing Authentication for Critical Function
- CWE-20Improper Input Validation