CVE-2025-32461
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 21.12, 24.8, 27.2, 28.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Tiki Tiki
fixed in 21.12; From 22 · fixed in 24.8; From 25 · fixed in 27.2; From 28 · fixed in 28.3
References 7
tiki.org
gitlab.com
- tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358
- tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1
- tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0
- tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a
- tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc