UpHeron
All vulnerabilities

Servers and applications

CVE-2025-24019

Authenticated arbitrary file deletion in YesWiki <= 4.4.5

Severity
High 7.1
Published
21 Jan 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
4.5.0
Also known as
GHSA-43c9-gw4x-pcx6
Sources
NVD, Project advisories (GitHub)

Description

YesWiki is a wiki system written in PHP. In versions up to and including 4.4.5, it is possible for any authenticated user, through the use of the filemanager to delete any file owned by the user running the FastCGI Process Manager (FPM) on the host without any limitation on the filesystem's scope. This vulnerability allows any authenticated user to arbitrarily remove content from the Wiki…

Affected software

SoftwareAffected versions
YesWikiServers and applications · cpe:a:yeswiki:yeswiki
  • Every version before 4.5.0
YesWikiServers and applications · github:yeswiki/yeswiki
  • Every version before 4.5.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-24019
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24019
  • GitHub Advisory Database https://github.com/advisories/GHSA-43c9-gw4x-pcx6
  • github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-43c9-gw4x-pcx6