This vulnerability (CVE-2025-34113) affects multiple versions of Tiki Wiki CMS Groupware. It is caused by missing authentication controls for a critical function, specifically in the handling of the 'viewmode' GET parameter in the calendar module's PHP script. An authenticated user with permission to access the calendar can inject and execute arbitrary PHP code, resulting in remote code execution under the web server user context. The CVSS 4.0 score is 8.7, reflecting high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and the product is not a cloud service.

Successful exploitation leads to remote code execution on the affected server with the privileges of the web server user. This can compromise the confidentiality, integrity, and availability of the system and potentially allow attackers to execute arbitrary commands or code remotely. The vulnerability requires authenticated access with calendar module permissions, limiting exposure to authorized users only. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the calendar module to trusted users only and monitor for suspicious activity related to the 'viewmode' parameter. Avoid granting unnecessary calendar permissions to users. Follow vendor communications closely for updates on patches or official mitigations.