CVE-2025-34111: Tiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCE
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendorextra/elfinder/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34111?
CVE-2025-34111 is considered a critical vulnerability due to its potential to allow remote attackers to execute arbitrary PHP scripts.
How do I fix CVE-2025-34111?
To fix CVE-2025-34111, upgrade to Tiki Wiki CMS Groupware version 15.2 or later to patch the vulnerability.
Who is affected by CVE-2025-34111?
CVE-2025-34111 affects all versions of Tiki Wiki CMS Groupware up to and including version 15.1.
What type of vulnerability is CVE-2025-34111?
CVE-2025-34111 is an unauthenticated arbitrary file upload vulnerability.
Can CVE-2025-34111 lead to a data breach?
Yes, CVE-2025-34111 can lead to data breaches as it allows attackers to upload and execute malicious files.