This vulnerability (CVE-2025-34113) affects Tiki Wiki CMS Groupware versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14. It is an authenticated command injection vulnerability located in the 'viewmode' GET parameter of the tiki-calendar.php file. When the calendar module is enabled and accessed by an authenticated user with calendar permissions, an attacker can inject arbitrary PHP code, leading to remote code execution under the web server's privileges. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and privileges required. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function), CWE-20 (Improper Input Validation), and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No patch or vendor advisory is currently provided.

Successful exploitation allows an authenticated user with calendar access permissions to execute arbitrary PHP code on the server, resulting in remote code execution with the privileges of the web server user. This could lead to full compromise of the affected system depending on the server configuration and privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict calendar module access to trusted users only and monitor for suspicious activity related to the 'viewmode' parameter. Avoid enabling the calendar module if not necessary. Follow vendor updates closely for any released patches or official mitigations.