{"cve":"CVE-2025-46348","nvd":{"published":"2025-04-29T21:15:52.120","modified":"2026-06-17T09:26:16.843","status":"Analyzed","description":"YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated. This could result in a malicious attacker making numerous requests to create archives and fill up the file system, or by downloading the archive which contains sensitive site information. This issue has been patched in version 4.5.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-862","CWE-287"],"references":["https://github.com/YesWiki/yeswiki/commit/0d4efc880a727599fa4f6d7a64cc967afe475530","https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95","https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wc9g-6j9w-hr95"],"products":["yeswiki:yeswiki"],"source":"nvd","synced_at":"2026-10-19T22:01:11.054312287+00:00"},"epss":{"cve":"CVE-2025-46348","score":0.00665,"percentile":0.51786,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}