Tiki vulnerabilities
We track 2 vulnerabilities in Tiki products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2025.
2vulnerabilities
2critical
0high
0exploited
9.9average CVSS score
Latest Tiki vulnerabilities
- 9.8 Critical severity
Wiki CMS Groupware: Unrestricted Upload of File with Dangerous Type
An unauthenticated arbitrary file upload vulnerability exists in Tiki Wiki CMS Groupware version 15.1 and earlier via the ELFinder component's default connector (connector.minimal.php), which allows remote attackers to upload and execute malicious PHP scripts
- 9.9 Critical severity
Tiki: Improper Neutralization of Special Elements Used in a Template Engine
wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.