CVE-2025-34113
Published: 15 July 2025
Summary
CVE-2025-34113 is a high-severity Improper Input Validation (CWE-20) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 contain an authenticated command injection vulnerability in the calendar module. The flaw is triggered through the viewmode GET parameter in tiki-calendar.php when that module is enabled, allowing unsanitized input to reach code execution paths classified under CWE-20, CWE-78, and CWE-306.
An attacker who possesses valid credentials and calendar access permissions can supply a crafted viewmode value to inject and execute arbitrary PHP code on the server. Successful exploitation grants remote code execution in the context of the web server process, with a CVSS 4.0 score of 8.7 reflecting network-accessible attack complexity that requires only low privileges.
Tiki’s security advisory and downstream sources such as VulnCheck and Acunetix direct administrators to apply the published patches for all maintained branches. Public exploit artifacts, including a Metasploit module and an Exploit-DB entry, have been available since disclosure, yet the EPSS score has remained flat at 0.6439.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21426
Vulnerability details
An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it,…
more
an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Directly implements checks on information inputs to reject invalid data before processing.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.