CVE-2025-32461

CRITICALNVD 9.99.9—

9.9

wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.

CVSS v3: 9.9
EG Score: 9.9(medium)
EPSS: 56.9%
KEV: Not listed

Published

April 9, 2025

Last Modified

April 15, 2026

Advisory Details (8)

Auto-updated May 16, 2026

No patch confirmed yet.

generic

Full Disclosure: Tiki Wiki CMS Groupware <= 28.3 Two Server-Side Template Injection Vulnerabilities

http://seclists.org/fulldisclosure/2025/Jul/11

generic

New Security Update Released for Tiki 21.x LTS and Upgrade is Strongly Recommended

https://tiki.org/article518

generic

New Security Updates Released for Tiki 28.x, 27.x LTS and 24.x LTS and Upgrade is Strongly Recommended

https://tiki.org/article517

generic

[FIX] Undefined Sanitize eval in include tpl (f3f36c1a) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc

generic

Eval sanitization (be8dc1aa) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358

generic

[BP][FIX] Undefined Sanitize eval in include tpl (9ffb4ab2) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a

generic

[BP][FIX] Undefined Sanitize eval in include tpl (801ed912) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1

generic

[BP][FIX] Undefined Sanitize eval in include tpl (406bea4f) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

CWE-1336Improper Neutralization of Special Elements Used in a Template Engine (SSTI)

Data Freshness Timeline

(refreshed 20× in last 7d / 20× in last 30d)

Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.

2026-05-31 22:30 UTCepss_batch
2026-05-31 22:30 UTCepss_batch
2026-05-31 00:50 UTCOSV refresh
2026-05-31 00:16 UTCepss_batch
2026-05-31 00:16 UTCepss_batch
2026-05-29 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-28 13:44 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-27 13:40 UTCepss_batch
2026-05-26 13:43 UTCepss_batch
2026-05-26 13:43 UTCepss_batch
2026-05-26 13:43 UTCepss_batch
2026-05-26 13:43 UTCepss_batch
2026-05-26 07:18 UTCepss_batch

Frequently asked(5)

What is CVE-2025-32461?

CVE-2025-32461 is a critical vulnerability published on April 9, 2025. wikipluginincludetpl in lib/wiki-plugins/wikipluginincludetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.

When was CVE-2025-32461 disclosed?

CVE-2025-32461 was first published in the National Vulnerability Database on April 9, 2025, with the most recent update on April 15, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.

Is CVE-2025-32461 actively exploited?

CVE-2025-32461 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 56.9% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.

What is the CVSS score of CVE-2025-32461?

CVE-2025-32461 has a CVSS v3 base score of 9.9 (NVD).

How do I remediate CVE-2025-32461?

Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2025-32461, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-32461

Explore →

Is Your Infrastructure Affected by CVE-2025-32461?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs

CVE-2025-32461

📅 Published

🔄 Last Modified

📋 Advisory Details (8)

Full Disclosure: Tiki Wiki CMS Groupware <= 28.3 Two Server-Side Template Injection Vulnerabilities

New Security Update Released for Tiki 21.x LTS and Upgrade is Strongly Recommended

New Security Updates Released for Tiki 28.x, 27.x LTS and 24.x LTS and Upgrade is Strongly Recommended

[FIX] Undefined Sanitize eval in include tpl (f3f36c1a) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

Eval sanitization (be8dc1aa) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

[BP][FIX] Undefined Sanitize eval in include tpl (9ffb4ab2) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

[BP][FIX] Undefined Sanitize eval in include tpl (801ed912) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

[BP][FIX] Undefined Sanitize eval in include tpl (406bea4f) · Commits · Tiki Wiki CMS Groupware / Tiki · GitLab

Weakness Classification(1)

Data Freshness Timeline

❓ Frequently asked(5)

Dependency Blast Radius

Is Your Infrastructure Affected by CVE-2025-32461?

🔗 Related CVEs(same CWE)

Same CWE

Published

Last Modified

Advisory Details (8)

Frequently asked(5)

Related CVEs(same CWE)