CVE-2025-32461

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32461
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32461.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32461
Published
2025-04-09T00:00:00Z
Modified
2026-10-28T02:30:37Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-1336"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32461.json"
}
References

Affected packages

Git / gitlab.com/tikiwiki/tiki

Affected ranges

Type
GIT
Repo
https://gitlab.com/tikiwiki/tiki
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bf5113b89684a22604cc9482c7b0a3b62266c3eb
Introduced
349656d845094f84bbdd2223fae62eba4877e9a5
Fixed
07d523e441369a53c83a288186e94a5d413955c9
Introduced
798892e5737a719fd0456f51a570adc2c8390c0b
Fixed
465d1f28f2cdca20f00b3ec7b369e022013bc560
Introduced
3635ac0de7f8cbf88cf9b8f269bb0b8a1fb799a4
Fixed
79d58f1a423ef4463240930fffec652a8a93a678
Fixed
be8dc1aa220fbceb07a7a5dc36416243afccd358
Fixed
801ed912390c2aa6caf12b7b953e200f5d4bc0b1
Fixed
406bea4f6c379a23903ecfd55e538d90fd669ab0
Fixed
9ffb4ab21bd86837370666ecd6afd868f3d7877a
Fixed
f3f36c1ac702479209acfcaec5789d2fd1f996bc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "21.12"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "22"
                },
                {
                    "fixed":  "24.8"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "25"
                },
                {
                    "fixed":  "27.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "28"
                },
                {
                    "fixed":  "28.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "be8dc1aa220fbceb07a7a5dc36416243afccd358"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "801ed912390c2aa6caf12b7b953e200f5d4bc0b1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "406bea4f6c379a23903ecfd55e538d90fd669ab0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "9ffb4ab21bd86837370666ecd6afd868f3d7877a"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "f3f36c1ac702479209acfcaec5789d2fd1f996bc"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

tags/21.*
tags/21.0
tags/21.0RC1
tags/21.0beta
tags/21.1
tags/21.10
tags/21.11
tags/21.2
tags/21.3
tags/21.4
tags/21.5
tags/21.6
tags/21.7
tags/21.9
tags/24.*
tags/24.0
tags/24.0RC1
tags/24.0alpha
tags/24.0beta
tags/24.1
tags/24.2
tags/24.3
tags/24.4
tags/24.5
tags/24.6
tags/24.7
tags/27.*
tags/27.0
tags/27.0RC1
tags/27.0alpha
tags/27.0beta
tags/27.1
tags/28.*
tags/28.0
tags/28.1
tags/28.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32461.json"