CVE-2025-24018

Summary

CVE-2025-24018 is a stored XSS vulnerability affecting YesWiki, a PHP-based wiki system. In versions up to 4.4.5, authenticated users with editing or commenting rights can exploit this vulnerability through the `{{attach}}` component's file upload feature. If the specified file doesn't exist, the server generates a file upload button with the filename of the attacker's choice. This vulnerability enables malicious users to steal accounts, modify pages and comments, extract user data, and disrupt the availability and confidentiality of YesWiki instances. The issue is resolved in version 4.5.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.