CVE-2025-34113: Tiki Wiki CMS Authenticated Command Injection in Calendar Module
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34113?
CVE-2025-34113 is a medium-severity command injection vulnerability affecting certain versions of Tiki Wiki CMS.
How do I fix CVE-2025-34113?
To fix CVE-2025-34113, upgrade to Tiki Wiki CMS versions greater than 14.1, 12.4 LTS, 9.10 LTS, and 6.14.
Which versions of Tiki Wiki CMS are affected by CVE-2025-34113?
Tiki Wiki CMS versions 14.1, 12.4 LTS, 9.10 LTS, and 6.14 are affected by CVE-2025-34113.
What type of vulnerability is CVE-2025-34113?
CVE-2025-34113 is classified as an authenticated command injection vulnerability.
Can an attacker exploit CVE-2025-34113 without authentication?
No, an attacker must be an authenticated user with permission to access the calendar module to exploit CVE-2025-34113.