YesWiki anfällig für authentifiziertes, willkürliches Löschen von Dateien

The impact of CVE-2025-24019 is substantial. An attacker, once authenticated within the YesWiki system, can leverage the filemanager to delete any file accessible to the FPM user. This includes critical configuration files, website assets, and potentially even system files depending on the server's setup. In containerized environments, this could allow an attacker to delete core YesWiki files, effectively crippling the application. The lack of filesystem scope limitations amplifies the risk, allowing deletion across a broad range of files. Successful exploitation could result in complete website defacement, data exfiltration (if sensitive data is stored in accessible files), and potential denial of service.

Organizations using YesWiki, particularly those with containerized deployments or shared hosting environments, are at risk. Legacy configurations with weak authentication or overly permissive file permissions are especially vulnerable. Users relying on YesWiki for critical documentation or knowledge management should prioritize patching.

• php: Examine web server access logs for requests to the filemanager endpoint with suspicious parameters that could indicate file deletion attempts. Look for patterns like ?file=../../../../etc/passwd.

grep -i 'file=../../' /var/log/apache2/access.log

• linux / server: Monitor FPM user processes for unexpected file activity. Use lsof to identify which processes have open files that are being deleted.

lsof -u www-data | grep deleted

• generic web: Check response headers for unusual content types or error messages after attempting to access or delete files through the filemanager. Look for 403 Forbidden errors or unexpected file listings.

1. 2025-01-21Disclosure

   disclosure

1. Reserviert2025-01-16
2. Veröffentlicht2025-01-21
3. Geändert2025-02-12
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-24019 is to upgrade YesWiki to version 4.5.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider restricting the permissions of the FPM user to minimize the potential damage from file deletion. Implement strict access controls within the filemanager to limit which files authenticated users can access and modify. Web Application Firewalls (WAFs) configured to detect and block suspicious file deletion requests targeting the filemanager endpoint can provide an additional layer of defense. Monitor YesWiki logs for unusual file access or deletion activity.