CVE-2017-14925: Cross-Site Request Forgery (CSRF) vulnerability via IMG element in Tiki before 16.3, 17.x before 17.1, 12 L...

Security readout for executives and security teams

This flaw affects older Tiki installations. A logged-in attacker could prepare wiki content that abuses an administrator’s browser session when the administrator opens the page. The reported impact is severe: global permissions could be changed, including granting administrator-level access to unauthenticated users. Exposure is limited to organizations running affected Tiki versions, especially sites where authenticated users can create or edit wiki pages viewed by administrators. Prioritize remediation for internet-facing or collaborative Tiki sites. The issue can convert administrator browsing into site-wide permission compromise, but evidence here does not show active exploitation. Mitigation focus: Upgrade Tiki to 16.3, 17.1, 12.12 LTS, 15.5 LTS, or later supported releases.; Review vendor release notes and security guidance for branch-specific upgrade requirements.; Restrict wiki editing to trusted users until the affected instance is upgraded..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.