What’s Vulnerable › Vulnerabilities

CVE-2025-32461

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-09 · updated 2026-06-17
• Weakness: CWE-1336

Description

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.

Affected products

• Tiki: before 21.12; from 22 before 24.8; from 25 before 27.2; from 28 before 28.3 — fixed in 21.12, 24.8, 27.2, 28.3

How to fix

Upgrade to a fixed version: Tiki 21.12, 24.8, 27.2, 28.3. Check the vendor advisory for mitigations.

References

• https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0
• https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1
• https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a
• https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358
• https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc
• https://tiki.org/article517
• https://tiki.org/article518
• http://seclists.org/fulldisclosure/2025/Jul/11

Get alerted when CVE-2025-32461 or the next vulnerability affects your stack