CVE-2025-31131

Path Traversal allowing arbitrary read of files in Yeswiki

YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.

Affected

YesWiki · yeswiki

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 GITHUB

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

5.47% chance of exploitation in the next 30 days, 93rd percentile

Nuclei

high · CWE-22

Published

2025-04-01

Proof-of-concept exploits (3)

• YesWiki/yeswiki/security/advisories/GHSA-w34w-fvp3-68xm
• MuhammadWaseem29/CVE-2025-311312★ · 2025-04-04
• gmh5225/Blackash-CVE-2025-311310★ · 2025-06-07

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-31131.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52135

Security advisories

• advisories/GHSA-w34w-fvp3-68xm
• YesWiki/yeswiki/commit/f78c915369a60c74ab8f38561ae93a4aaca9b989

References

• CVE Record
• NVD entry

Related

• CVE-2025-1661
• CVE-2025-24016
• CVE-2025-24799
• CVE-2025-24813
• CVE-2025-29927
• CVE-2025-31125