UpHeron
All vulnerabilities

Servers and applications

CVE-2025-31131

Path Traversal allowing arbitrary read of files in Yeswiki v4.5.1

Severity
High 7.5
Published
1 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
3 Nov 2026
Fixed in
4.5.2
Also known as
GHSA-w34w-fvp3-68xm
Sources
NVD, Project advisories (GitHub)

Description

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.

Affected software

SoftwareAffected versions
YesWikiServers and applications · cpe:a:yeswiki:yeswiki
  • Every version before 4.5.2
YesWikiServers and applications · github:yeswiki/yeswiki
  • Every version before 4.5.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-31131
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-31131
  • GitHub Advisory Database https://github.com/advisories/GHSA-w34w-fvp3-68xm
  • github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xm