Issue List
VWE-2025-6644 is a Denial of Service issue, where a user can replace regular non-wiki content with a fatal error by posting a GALLERY tag. The issue affects VaultWiki 4.1.6 and higher, on vBulletin and XenForo 1.x platforms only.VWE-2025-6645 is a Permissions Escalation issue, where a sandbox break can occur while rendering a BB-Code tag with parsible advanced-style tag options, which generally applies to all BB-Code tags with advanced-style tag options, such as unfurlable URL tags, when used within a wiki template context. Such a tag's child content that should normally be unrendered according to sandbox rules may be unexpectedly rendered anyway. The issue affects all versions of the VaultWiki 4.1.x series, on XenForo 2.x platforms only.
VWE-2025-6646 is an Upgrade issue, where initiating the upgrade process could trigger a fatal error. The issue affects VaultWiki 4.1.8 Patch Level 1, on XenForo 2.x platforms only.
Patches
The following patches address the aforementioned issues:- 4.1.8 Patch Level 2