CVE-2025-46348
📋 TL;DR
CVE-2025-46348 is an authentication bypass vulnerability in YesWiki that allows unauthenticated attackers to trigger and download site backups. The predictable backup filenames enable attackers to fill up disk space through repeated requests or exfiltrate sensitive site data. All YesWiki installations prior to version 4.5.4 are affected.
💻 Affected Systems
- YesWiki
📦 What is this software?
Yeswiki by Yeswiki
⚠️ Risk & Real-World Impact
Worst Case
Complete site compromise through sensitive data exfiltration (database credentials, user data, configuration files) and denial of service via disk exhaustion.
Likely Case
Unauthorized backup downloads exposing sensitive site information and potential disk space exhaustion attacks.
If Mitigated
Minimal impact with proper authentication controls and monitoring in place.
🎯 Exploit Status
Simple HTTP requests to backup endpoints with predictable filenames; trivial to automate.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.4
Vendor Advisory: https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95
Restart Required: No
Instructions:
1. Backup your YesWiki installation. 2. Download YesWiki 4.5.4 from official repository. 3. Replace existing files with new version. 4. Verify authentication is required for backup functionality.
🔧 Temporary Workarounds
Block Backup Endpoints
allUse web server configuration to block unauthenticated access to backup endpoints
# Apache: RewriteRule ^/backup - [F]
# Nginx: location ~ /backup { deny all; }
Implement Rate Limiting
linuxLimit requests to backup endpoints to prevent disk exhaustion attacks
# Using fail2ban or similar tools to limit backup endpoint requests
🧯 If You Can't Patch
- Implement strict network access controls to limit YesWiki access to trusted users only
- Monitor disk usage and backup directory for unusual activity or rapid file creation
🔍 How to Verify
Check if Vulnerable:
Attempt to access /backup endpoint without authentication; if backup can be triggered/downloaded, system is vulnerable.Check Version:
Check YesWiki version in admin panel or examine version.php fileVerify Fix Applied:
Verify that authentication is required to access backup functionality and backup filenames are no longer predictable.📡 Detection & Monitoring
Log Indicators:
- Multiple backup requests from single IP
- Unauthenticated access to backup endpoints
- Rapid backup file creation
Network Indicators:
- HTTP requests to /backup without authentication headers
- Unusual download patterns of backup files
SIEM Query:
source="web_server" AND (uri_path="/backup" OR uri_path LIKE "%/backup%") AND NOT (auth_status="success")