CVE-2019-15314: Tiki Tikiwiki Cms/groupware

Medium severity, CVSS 5.4. EPSS: 0.9% chance of exploitation in the next 30 days.

tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.

Affected products

• Tiki Tikiwiki Cms/groupware: version 18.4 only

Published 2019-08-22. Last modified 2026-06-17.