An authenticated command injection vulnerability exists in the Calendar module of Tiki Wiki CMS. By manipulating the viewmode GET parameter in tiki-calendar.php, an attacker can inject arbitrary PHP code and execute it on the server as the web‑server user, giving full control of the affected system.

The flaw affects all releases of Tiki Wiki CMS that include the calendar module and are version 14.1 or earlier, 12.4 LTS or earlier, 9.10 LTS or earlier, and 6.14 or earlier, supplied by the Tiki Software Community Association under the Wiki CMS Groupware umbrella.

The CVSS score of 8.7 marks the vulnerability as high severity while an EPSS score of 44% suggests that exploitation is likely in the wild. The issue requires authenticated access but the wide use of the Calendar component means many sites could be exposed. It is not yet listed in the CISA KEV catalog. Successful exploitation leads to remote code execution with the privileges of the web server, enabling total compromise of the host and further lateral attack vectors.