CVE-2025-34113highCWE-20CWE-306CWE-78

CVE-2025-34113: high-severity vulnerability in Tiki Software Community Association Wiki CMS…

Tiki Wiki CMS Authenticated Command Injection in Calendar Module

Published · Updated

Follow this CVE+ Monitor Wiki CMS Groupware

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 8.7epss 3.0%
from disclosure to weaponsame day
Published on NVDJul 15
metasploitJun 6
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Tiki Software Community Association · Wiki CMS Groupware
Related CVEs — Tiki Software Community Association Wiki CMS…

In the same product, most dangerous first.

CVE-2025-34111CRITICALTiki Wiki <= 15.1 ELFinder Unauthenticated File Upload RCEEPSS 2.6%