CVE-2025-34111: tiki software community association wiki cms groupware Improper Input Validation

Vulnerability summary

CVE-2025-34111 is a critical (CVSS 9.8) Improper Input Validation vulnerability in tiki software community association wiki cms groupware. EPSS estimates a 2.57% chance of exploitation in the next 30 days, higher than 84.9% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 15-07-2025
   PublishedVulnerability first disclosed.
2. 15-05-2026
   Last modifiedVulnerability information updated.

Description

An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts in the context of the web server. The vulnerable component does not enforce file type validation, allowing attackers to craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at /vendor_extra/elfinder/.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.