CVE-2025-31131CWE-22
Path Traversal allowing arbitrary read of files in Yeswiki
High · published April 1, 2025
What it is
YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.
The record
Technical detail
- CVSS v3.1
- 8.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.05474 · 92.7th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2025-04-01T14:56Z
EPSS history
Timeline