This vulnerability (CVE-2025-34111) affects Tiki Wiki CMS Groupware through the ELFinder file manager component's default connector (connector.minimal.php). The issue is an unrestricted file upload flaw (CWE-434) that allows unauthenticated attackers to upload malicious PHP files without file type validation. Exploitation can lead to remote code execution in the context of the web server. The vulnerability is present in all versions up to and including 15.1. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary PHP code on the affected server, potentially leading to full system compromise, data theft, or service disruption. The vulnerability requires no authentication and can be triggered remotely, making it highly dangerous. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the ELFinder component, disable or remove the vulnerable connector if possible, or implement web application firewall (WAF) rules to block malicious file upload attempts targeting the ELFinder interface at /vendor_extra/elfinder/. Monitor vendor channels for updates and apply official patches once available.