{"id":"CVE-2025-32461","details":"wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in Tiki before 28.3 mishandles input to an eval. The fixed versions are 21.12, 24.8, 27.2, and 28.3.","modified":"2026-08-31T11:30:47.544440234Z","published":"2025-04-09T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32461.json","cna_assigner":"mitre","cwe_ids":["CWE-1336"]},"references":[{"type":"WEB","url":"http://seclists.org/fulldisclosure/2025/Jul/11"},{"type":"WEB","url":"https://tiki.org/article517"},{"type":"WEB","url":"https://tiki.org/article518"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32461.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32461"},{"type":"FIX","url":"https://gitlab.com/tikiwiki/tiki/-/commit/406bea4f6c379a23903ecfd55e538d90fd669ab0"},{"type":"FIX","url":"https://gitlab.com/tikiwiki/tiki/-/commit/801ed912390c2aa6caf12b7b953e200f5d4bc0b1"},{"type":"FIX","url":"https://gitlab.com/tikiwiki/tiki/-/commit/9ffb4ab21bd86837370666ecd6afd868f3d7877a"},{"type":"FIX","url":"https://gitlab.com/tikiwiki/tiki/-/commit/be8dc1aa220fbceb07a7a5dc36416243afccd358"},{"type":"FIX","url":"https://gitlab.com/tikiwiki/tiki/-/commit/f3f36c1ac702479209acfcaec5789d2fd1f996bc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/tikiwiki/tiki","events":[{"introduced":"0"},{"fixed":"bf5113b89684a22604cc9482c7b0a3b62266c3eb"},{"introduced":"349656d845094f84bbdd2223fae62eba4877e9a5"},{"fixed":"07d523e441369a53c83a288186e94a5d413955c9"},{"introduced":"798892e5737a719fd0456f51a570adc2c8390c0b"},{"fixed":"465d1f28f2cdca20f00b3ec7b369e022013bc560"},{"introduced":"3635ac0de7f8cbf88cf9b8f269bb0b8a1fb799a4"},{"fixed":"79d58f1a423ef4463240930fffec652a8a93a678"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"21.12"},{"introduced":"22"},{"fixed":"24.8"},{"introduced":"25"},{"fixed":"27.2"},{"introduced":"28"},{"fixed":"28.3"}]}}],"versions":["tags/28.2","tags/28.1","tags/28.0","tags/21.11","tags/21.10","tags/24.7","tags/27.1","tags/27.0","tags/27.0RC1","tags/27.0beta","tags/27.0alpha","tags/24.6","tags/24.5","tags/21.9","tags/24.4","tags/24.3","tags/21.7","tags/24.2","tags/21.6","tags/24.1","tags/24.0","tags/24.0RC1","tags/24.0beta","tags/24.0alpha","tags/21.5","tags/21.4","tags/21.3","tags/21.2","tags/21.1","tags/21.0","tags/21.0RC1","tags/21.0beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32461.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}