CVE-2025-46349: YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication
This Proof of Concept has been performed using the followings:
- YesWiki v4.5.3 (doryphore-dev branch)
- Docker environnment (docker/docker-compose.yml)
References
- github.com/YesWiki/yeswiki
- github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php
- github.com/YesWiki/yeswiki/commit/0dac9e2fb2a5e69f13a3c9f761ecae6ed9676206
- github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2
- github.com/advisories/GHSA-2f8p-qqx2-gwr2
- nvd.nist.gov/vuln/detail/CVE-2025-46349
Code Behaviors & Features
Detect and mitigate CVE-2025-46349 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →