CVE-2025-34111 is a critical (CVSS 9.8) unauthenticated file upload flaw in Tiki Wiki CMS Groupware 15.1 and earlier, through the ELFinder connector. It allows PHP code to be placed on the server. Tiki 15.2, 14.4 and 12.9 LTS are the releases named in the vendor announcement.
What's affected
The record lists Tiki Wiki CMS Groupware version 15.1 and earlier. The Tiki security announcement names Tiki 15.2, Tiki 14.4 and Tiki 12.9 LTS as the updated releases. It describes the fix only as addressing a critical vulnerability in third party code included with Tiki, and it does not name a CVE or component, so the match to this CVE comes from the NVD record and the public references it cites.
Because the fix lines are old, many installations may be several major versions behind. Upgrading to a currently supported Tiki release is the sensible goal, not only the minimum.
How to check if you're exposed
Find the Tiki version in the admin area, or in the version file shipped in the installation. If it is 15.1 or earlier, you are in range.
Then look for the ELFinder connector. The record names connector.minimal.php. Search your web root for files with that name and check whether they can be reached without logging in. Review your web server access logs for requests to that file, and look in upload and file gallery directories for files with unexpected extensions such as .php.
A DAST scan against the site can also show which paths are reachable without authentication.
What to do now
- Confirm the Tiki version on every site you host, including old wikis nobody remembers.
- Upgrade to a current supported Tiki release. At minimum use 15.2, 14.4 or 12.9 LTS, as the vendor announcement names.
- Block public access to connector files through your web server configuration while you plan the upgrade.
- Search upload directories for executable files and remove those you cannot explain.
- Disable PHP execution in upload and file gallery directories.
- Restore from a clean backup and rotate credentials if you find a web shell.
Why it matters
The record maps this to CWE-434 (unrestricted upload of a dangerous file type), CWE-306 (missing authentication) and CWE-20 (improper input validation). The connector accepts files without checking type and without requiring a login, so an uploaded script runs with the rights of the web server.
Upload handling is one of the oldest ways to take over a PHP site, and bundled third party components are a common source. The record does not flag exploitation in the wild, and the CVE is not on the CISA KEV list. A public exploit module is listed among the references, which makes older, unpatched sites easy to target.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Tiki releases does the vendor announcement name?
Tiki 15.2, Tiki 14.4 and Tiki 12.9 LTS, for a critical flaw in bundled third party code.
What file does the record name?
The ELFinder default connector, connector.minimal.php.
Sources
Last reviewed: 18 October 2026.
