CVE-2025-46349: Yeswiki Reflected XSS Vulnerability

CVE-2025-46349 Overview

CVE-2025-46349 is a reflected cross-site scripting (XSS) vulnerability in YesWiki, an open-source wiki system written in PHP. The flaw resides in the file upload form and affects all versions prior to 4.5.4. Unauthenticated attackers can craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser session. The attacker can then perform arbitrary actions in the context of the authenticated user, including account manipulation and content modification. The issue is tracked under CWE-79 and has been patched in YesWiki version 4.5.4.

Critical Impact
A single crafted link is sufficient to hijack an authenticated administrator's session, enabling arbitrary actions across the wiki without prior credentials.

Affected Products

YesWiki versions prior to 4.5.4
YesWiki file upload form component
PHP-based YesWiki deployments across all supported platforms

Discovery Timeline

2025-04-29 - CVE-2025-46349 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46349

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the YesWiki file upload form. YesWiki reflects user-controlled input from the request back into the rendered HTML response without adequate output encoding or sanitization. An attacker constructs a URL containing malicious JavaScript payload parameters and delivers it to the victim through phishing, chat, or embedded links. When the victim, typically an authenticated user, loads the URL, the payload executes in their browser under the origin of the wiki. The vulnerability requires user interaction and can cross security boundaries because the executed script runs with the victim's session privileges. Consequences include session token theft, forced administrative actions, defacement, and pivoting to further wiki compromise.

Root Cause

The root cause is missing or insufficient neutralization of input during web page generation in the file upload form handler. User-supplied parameters are echoed into the HTML response without HTML entity encoding or context-aware escaping. Because no authentication is required to reach the vulnerable endpoint, any external attacker can trigger the reflection path.

Attack Vector

The attack is delivered over the network and requires the victim to click a crafted link. The attacker hosts or distributes a URL targeting the YesWiki upload form endpoint with a JavaScript payload embedded in a reflected parameter. On page load, the browser parses and executes the injected script under the wiki's origin. See the GitHub Security Advisory GHSA-2f8p-qqx2-gwr2 for details.

Detection Methods for CVE-2025-46349

Indicators of Compromise

Web server access logs containing requests to YesWiki file upload endpoints with URL parameters containing <script>, javascript:, onerror=, onload=, or encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external domains, chat platforms, or shortened URL services immediately before privileged wiki actions.
Unexpected content modifications, new administrative accounts, or configuration changes tied to a single user session shortly after clicking an external link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect query strings and form fields submitted to YesWiki upload endpoints for HTML tags and event handler attributes.
Correlate outbound clicks in email or messaging telemetry with subsequent authenticated requests to YesWiki, flagging session activity that originates from external referers.
Enable Content Security Policy (CSP) reporting to receive violation reports when inline scripts execute from injected payloads.

Monitoring Recommendations

Monitor YesWiki application logs for anomalous parameter values on upload form URLs, including long query strings and encoded angle brackets.
Track administrative actions performed within short intervals after page loads from unusual referers.
Alert on any YesWiki instance still reporting a version string below 4.5.4 in HTTP responses or generator meta tags.

How to Mitigate CVE-2025-46349

Immediate Actions Required

Upgrade all YesWiki instances to version 4.5.4 or later, which contains the official patch for CVE-2025-46349.
Invalidate active administrator sessions and rotate credentials for any account that may have clicked suspicious links prior to patching.
Review recent wiki changes, user account creations, and permission modifications for signs of unauthorized action.

Patch Information

The YesWiki maintainers released the fix in version 4.5.4. The corrective code changes are available in the merged pull request at YesWiki PR #1264 commit 6edde40. The patch adds proper output encoding for user-supplied values reflected by the file upload form.

Workarounds

Restrict access to the YesWiki file upload form via network controls or authentication proxies until the upgrade is applied.
Deploy a strict Content Security Policy that disallows inline scripts to blunt reflected XSS payload execution.
Configure WAF signatures to block requests containing HTML tag or JavaScript event handler patterns in query parameters targeting YesWiki endpoints.

bash

# Example nginx CSP header to reduce reflected XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;