wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3…
Priority MEDIUM 45CWE-1336Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-1336.
Summary
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00939 61st percentileScored 2026-11-07
Fix Fixed Tiki (Tiki): 21.12, 24.8, 27.2 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tiki Wiki | Tiki | before 21.12; 22 to before 24.8; 25 to before 27.2; 28 to before 28.3 | 21.12, 24.8, 27.2, 28.3 | Patch available | CNA |
- Tiki VendorTiki Wiki Affected before 21.12; 22 to before 24.8; 25 to before 27.2; 28 to before 28.3 Fixed in 21.12, 24.8, 27.2, 28.3 Patch available CNA
Remediation
- Fix · CNA Tiki (Tiki) Fixed in 21.12, 24.8, 27.2, 28.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32461
- 2026-10-03 Alias added: GHSA-v676-fw8h-j3j9
References
Other 7
- https://tiki.org/article517
- https://tiki.org/article518
- https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358
- https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1
- https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0
- https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a
- https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc
More Tiki Wiki vulnerabilities
- TI-2012-00837 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute… CVSS 3.1CRITICAL 9.8
- TI-2023-09004 Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP… CVSS 3.1HIGH 8.8
- TI-2005-01820 Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc)… CVSS 2.0HIGH 7.5
- TI-2007-05209 tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
- TI-2023-09005 Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection… CVSS 3.1HIGH 7.2
- TI-2020-12522 tiki-login.php in Tiki before 21.2 sets the admin password to a blank value after 50 invalid login attempts. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-32461 · CVE Program
- CVE-2025-32461 · NVD
- FIRST EPSS
- GHSA-v676-fw8h-j3j9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences