CVE-2025-32461

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions…

Critical9.9EPSS 0.94%

Published: 9 Apr 2025
Updated: 3 Nov 2025
Reserved: 9 Apr 2025
Assigned by: mitre

Description

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.

Scores

CVSS scores of CVE-2025-32461, by who scored it
Scored by	CVSS	Score	Vector
mitreCNA (assigner)	3.1	Critical9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVDNVD · Deferred	3.1	Critical9.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.94% · top 39% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.9.

Weakness

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine (opens in a new tab)All about CWE-1336 and its CVEs

Affected products

Tiki · Tiki
- affected < 21.12
- affected 22 – < 24.8
- affected 25 – < 27.2
- affected 28 – < 28.3

References (8)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2025-32461](https://trackcve.app/badge/CVE-2025-32461.svg)](https://trackcve.app/cve/CVE-2025-32461)

Record last updated 3 Nov 2025, 19:53 UTC.