CVE-2025-34113

Tiki Wiki CMS Authenticated Command Injection in Calendar Module

State: Published
Severity: 8.7 High
Published: Jul 15, 2025
Updated: May 15, 2026
Reserved: Apr 15, 2025

Description

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the `viewmode` GET parameter in `tiki-calendar.php`. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execute arbitrary PHP code. Successful exploitation leads to remote code execution in the context of the web server user.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-20 Improper Input Validation
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
Wiki CMS GroupwareTiki Software Community Association	14.1 and earlierAffected 12.4 LTS and earlierAffected 9.10 LTS and earlierAffected 6.14 and earlierAffected

References

https://tiki.org/article414-Important-Security-Fix-for-all-versions-of-Tikivendor-advisorypatch
https://www.exploit-db.com/exploits/39965exploit
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/tiki_calendar_exec.rbexploit
https://www.acunetix.com/vulnerabilities/web/tiki-wiki-cms-remote-code-execution-via-calendar-module/third-party-advisory
https://www.vulncheck.com/advisories/tiki-wiki-cms-authenticated-command-injection-in-calendar-modulethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.