CVE-2025-46348: Unauthenticated Backup Exploitation of YesWiki Prior to Version 4.5.4

Overview

The CVE-2025-46348 vulnerability is a critical flaw in the YesWiki system, a widely used wiki platform built with PHP. This vulnerability has far-reaching implications as it affects all versions prior to 4.5.4 and could potentially lead to system compromise or data leakage. The issue lies in the backup process of the system where unauthenticated users can create and download site backups, hence causing potential threats to the security of sensitive site data.

Vulnerability Summary

CVE ID: CVE-2025-46348
Severity: Critical (CVSS: 10.0)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System Compromise, Data Leakage

Affected Products

Product | Affected Versions

YesWiki | All versions prior to 4.5.4

How the Exploit Works

The exploit takes advantage of the vulnerability in the backup process of YesWiki systems where an unauthenticated user can initiate a backup and download it without needing authentication. Given that the system creates the archives with predictable filenames, an attacker can easily generate and download these archives. Moreover, this vulnerability can also be exploited to perform a Denial of Service (DoS) attack by continually creating archives until the file system is full.

Conceptual Example Code

While the exact code to exploit this vulnerability would vary, a conceptual example of a potential HTTP request to exploit this issue could look like this:

GET /backup/archive.tar.gz HTTP/1.1
Host: targetsite.com

In this example, `archive.tar.gz` is the predictable filename of the backup archive. A malicious actor could continuously send this request to both download the site’s backup and potentially fill up the server’s disk space.

Mitigation and Recommendations

The vulnerability has been patched in YesWiki version 4.5.4. Users are strongly recommended to update their systems to this version or later to prevent potential exploitation. For those who cannot immediately update their system, using a Web Application Firewall (WAF) or Intrusion Detection Systems (IDS) may provide a temporary mitigation. However, these are not long-term solutions and updating to the patched version remains the most secure option.