CVE-2025-46348 is a critical flaw (CVSS 10.0) in YesWiki, a PHP wiki, before version 4.5.4. A site backup can be started and downloaded without logging in, and the archive names are predictable. Upgrade to 4.5.4 and remove any backup archives left on the server.
What's affected
The NVD record says YesWiki versions before 4.5.4 are affected. The GitHub advisory lists the vulnerable range as 4.5.3 and below and names 4.5.4 as the patched release.
The advisory describes two problems that combine. The request that starts a backup does not need authentication. The archives are then written with predictable file names, so an outsider can guess the address and download the archive. According to the record, that archive contains sensitive site information, and repeated requests could also fill the file system.
How to check if you're exposed
Check the version and look for archives.
- Read the YesWiki version from the administration page or the project files, and compare it with 4.5.4.
- Docker users: run the command shown below to see the image tag.
- Look in the wiki's archive or backup directory for zip files you do not recognise, and for a long run of files created in a short period.
- Check web server logs for requests to the archives API path from addresses that are not administrators.
- Check free disk space on the server in case repeated backup requests have used it up.
If you find archives that you did not create, treat the data in them as exposed.
Commands referred to above, in order:
docker ps --format '{{.Image}}'
What to do now
- Upgrade YesWiki to 4.5.4 or later after taking your own backup.
- Delete leftover backup archives from the web accessible directory, and move your own backups outside the web root.
- If archives from unknown requests exist, rotate database credentials, admin passwords and any API keys stored in the wiki's configuration.
- Notify the people whose personal data the wiki holds if your review shows an archive was downloaded by someone unauthorised, as your legal duties require.
- Restrict access to administrative API paths at the web server or reverse proxy where practical.
- Review the related file write advisory, CVE-2025-46347, which is fixed in the same release.
Why it matters
The record lists CWE-287 (Improper Authentication), CWE-862 (Missing Authorization). A function that starts an expensive, sensitive operation, and returns the result, must check who is asking. This one did not, so the backup feature worked as a public download service.
The score of 10.0 reflects a changed scope in the CVSS vector, together with high impact on confidentiality, integrity and availability. In practice the main danger is the data inside the archive: site content, configuration and user records. Predictable file names turn a hidden file into a guessable one, which gives little protection. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Why is the score 10.0?
The vector shows network reach, low complexity, no login, no user interaction, a changed scope and high impact on all three areas.
Does upgrading remove the risk?
It closes the hole. Archives that were already created and left on disk still need to be found and removed.
Sources
Last reviewed: 18 October 2026.
