CVE-2025-24017

Summary

CVE-2025-24017 is a DOM-based XSS vulnerability affecting YesWiki, a PHP-based wiki system. Versions up to 4.4.5 are susceptible to this issue, which can be exploited by any user creating a malicious link. The flaw lies in the search by tag feature, where tags that do not exist are not properly sanitized on the server side. This allows a malicious user to generate a link that triggers XSS when clicked, leading to account takeover, page modification, comment manipulation, permission adjustment, and data extraction (including emails). These attacks pose risks to the YesWiki instance's integrity, availability, and confidentiality. Version 4.5.0 includes a patch to resolve this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.