CVE-2025-24018: Yeswiki Stored XSS Vulnerability

CVE-2025-24018 Overview

CVE-2025-24018 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in YesWiki, a PHP-based wiki system. The flaw affects all versions up to and including 4.4.5. An authenticated user with permission to edit pages or post comments can inject persistent JavaScript through the {{attach}} content component. The payload executes in the browser of any user who loads the affected page or comment.

Critical Impact
Authenticated attackers can hijack sessions, alter pages and permissions, and exfiltrate user data including email addresses, undermining the integrity, availability, and confidentiality of a YesWiki instance.

Affected Products

YesWiki versions up to and including 4.4.5
YesWiki yeswiki package (Composer / GitHub distributions)
Instances exposing edit or comment rights to untrusted authenticated users

Discovery Timeline

2025-01-21 - CVE CVE-2025-24018 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24018

Vulnerability Analysis

YesWiki content pages support the {{attach}} action, which lets authors attach files or media to a wiki page. When the resource referenced by the file attribute does not exist on the server, the attach library renders an upload button whose label contains the raw filename supplied by the author.

Because the filename is echoed into HTML without escaping, an attacker can craft a {{attach}} invocation whose file value contains HTML or JavaScript. The malicious markup is stored in the page or comment body and is executed each time another user renders the resource. Any user with page-edit or comment rights can plant the payload, and it reflects to every subsequent viewer, including administrators.

Root Cause

The root cause is missing output encoding in tools/attach/libs/attach.lib.php, inside showFileNotExits(). The $this->file property is concatenated directly into the anchor markup and its label text. No call to htmlspecialchars() or equivalent sanitizer is applied before echoing the value, allowing attribute-breaking characters and inline script content to persist through rendering.

Attack Vector

Exploitation requires an authenticated account with edit or comment permissions and user interaction from a victim who loads the poisoned page. The attacker submits a page or comment containing a {{attach}} tag referencing a non-existent filename that includes an XSS payload. When any other user opens the page, the browser parses the injected markup and executes attacker-controlled JavaScript in the session context of the victim, which can be used to steal session cookies, submit administrative actions, or scrape user data such as email addresses.

php

// Patch: tools/attach/libs/attach.lib.php - showFileNotExits()
// Source: https://github.com/YesWiki/yeswiki/commit/c1e28b59394957902c31c850219e4504a20db98b
public function showFileNotExits()
{
-    echo '<a href="' . $this->wiki->href('upload', $this->wiki->GetPageTag(), "file=$this->file") . '" class="btn btn-primary"><i class="fa fa-upload icon-upload icon-white"></i> ' . _t('UPLOAD_FILE') . ' ' . $this->file . '</a>';
+    $filename = htmlspecialchars($this->file);
+    echo '<a href="' . $this->wiki->href('upload', $this->wiki->GetPageTag(), "file=$filename") . '" class="btn btn-primary"><i class="fa fa-upload icon-upload icon-white"></i> ' . _t('UPLOAD_FILE') . ' ' . $this->file . '</a>';
}

The fix wraps the untrusted filename with htmlspecialchars() before embedding it in the URL query string. See the GitHub Security Advisory GHSA-w59h-3x3q-3p6j for the vendor write-up.

Detection Methods for CVE-2025-24018

Indicators of Compromise

Wiki page or comment revisions containing {{attach}} tags whose file attribute includes angle brackets, quotes, javascript:, or on*= handlers.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after rendering wiki pages.
Newly created administrator accounts or unexplained permission changes in the YesWiki triple store.

Detection Strategies

Grep the YesWiki database and page revisions for {{attach occurrences followed by non-alphanumeric characters in the file parameter.
Review web server logs for requests to ?action=upload with file= values containing encoded HTML metacharacters.
Deploy Content Security Policy (CSP) reporting to capture inline script violations that indicate stored XSS execution.

Monitoring Recommendations

Enable audit logging on page edits and comment submissions and alert on payloads containing script-like tokens.
Monitor authentication events for session reuse from unexpected IP addresses, which can indicate cookie theft.
Correlate wiki edit events with anomalous administrative actions such as permission changes or bulk data exports.

How to Mitigate CVE-2025-24018

Immediate Actions Required

Upgrade YesWiki to version 4.5.0 or later, which contains the sanitization fix.
Audit existing pages and comments for malicious {{attach}} tags and revert affected revisions.
Rotate session secrets and force re-authentication for all users after cleanup.

Patch Information

The fix is delivered in YesWiki 4.5.0 via commit c1e28b5, which applies htmlspecialchars() to the filename in showFileNotExits() and improves tag handling in TagsManager.php. Refer to the YesWiki security advisory GHSA-w59h-3x3q-3p6j for release notes.

Workarounds

Restrict edit and comment privileges to trusted accounts until the upgrade is applied.
Deploy a strict Content Security Policy that blocks inline scripts and untrusted event handlers.
Place a web application firewall rule in front of YesWiki to reject requests whose body contains {{attach}} values with HTML control characters.

bash

# Upgrade YesWiki to a patched release
git fetch --tags
git checkout v4.5.0
composer install --no-dev --optimize-autoloader
php tools/update.php