🚨 CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
GitHub
CSRF: page attachment deletion/purge via GET in filemanager handler
## Summary
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
🚨 CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
GitHub
CSRF: bulk tag-triple deletion via GET in admintag action
## Summary
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
🚨 CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
GitHub
Unauthenticated CPU-exhaustion DoS via O(n^2) regex in core wiki formatter (edit-preview)
## Summary
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
🚨 CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
GitHub
Unauthenticated read-ACL bypass leaks page body excerpts via recentchangesrssplus RSS
## Summary
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
🚨 CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
GitHub
Second-order SQL injection in AclService::updateRequestWithACL via unescaped username in read-ACL LIKE clause
## Summary
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
🚨 CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
GitHub
SQL injection in filtertags action via unescaped filterN parameter (backslash-escape breakout)
## Summary
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
🚨 CVE-2026-104458
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
GitHub
SSRF guard bypass via IPv6 6to4 / NAT64 / IPv4-compatible transition wrappers of internal IPs (incomplete fix of the Signature.keyId…
## Summary
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
🚨 CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
GitHub
SSRF via ActivityPub WebFinger handle resolution (actor_handle) - internal HTTPS reachability
## Summary
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
🚨 CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
GitHub
Unauthenticated blind SQL injection in YesWiki `{{newtextsearch}}` via unescaped Bazar list option id
### Summary
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
🚨 CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
GitHub
Stored XSS via unsanitized SVG upload in Bazar FileField (sanitization bypass)
## Summary
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
🚨 CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
GitHub
SQL injection in nuagetag action via unescaped tags parameter (backslash-escape breakout)
## Summary
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...
🚨 CVE-2026-104463
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed Follow activities to the public forms actor inbox route. Attackers sign requests with their own keyId while supplying internal actor URLs in the body, reaching internal hosts or cloud metadata via blind GET and POST requests.
🎖@cveNotify
GitHub
Unauthenticated SSRF via public ActivityPub inbox (body actor/to never validated)
## Summary
The public ActivityPub inbox route accepts a signed `Follow` activity whose JSON body `actor`/`to` fields are never validated, then performs server-side GET and POST requests to those at...
The public ActivityPub inbox route accepts a signed `Follow` activity whose JSON body `actor`/`to` fields are never validated, then performs server-side GET and POST requests to those at...
🚨 CVE-2026-104464
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries.
🎖@cveNotify
GitHub
SSRF via ActivityPub actor sync (abonnements&action=sync) - unvalidated actor URL
## Summary
The Bazar `abonnements` action's `sync` branch passes a raw, attacker-controlled `actor` URL straight to server-side HTTP fetches with no ACL check and no URL/scheme/IP validation, y...
The Bazar `abonnements` action's `sync` branch passes a raw, attacker-controlled `actor` URL straight to server-side HTTP fetches with no ACL check and no URL/scheme/IP validation, y...
🚨 CVE-2026-104465
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.
🎖@cveNotify
GitHub
Reflected XSS (Unauthenticated) in YesWiki v4.6.6 ("Field" Parameter at ?ValentinDouarre)
### Summary
A Reflected Cross-Site Scripting (XSS) vulnerability was identified on the YesWiki application in the field parameter. The application improperly reflects unsanitized user input into...
A Reflected Cross-Site Scripting (XSS) vulnerability was identified on the YesWiki application in the field parameter. The application improperly reflects unsanitized user input into...
🚨 CVE-2026-104466
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
🎖@cveNotify
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
🎖@cveNotify
GitHub
YesWiki Wakka markdown image rendering allows stored XSS through unescaped src attribute
### Summary
The Wakka formatter's markdown image compatibility path inserts the image `src` value into a double-quoted HTML attribute without escaping or URL validation. A user who can edit pa...
The Wakka formatter's markdown image compatibility path inserts the image `src` value into a double-quoted HTML attribute without escaping or URL validation. A user who can edit pa...
🚨 CVE-2026-104468
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.
🎖@cveNotify
YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts.
🎖@cveNotify
GitHub
YesWiki password reset links do not expire until used or replaced
### Summary
YesWiki password reset links are valid indefinitely until the user successfully resets the password or requests a new reset email. The reset token is stored as a triple without an issua...
YesWiki password reset links are valid indefinitely until the user successfully resets the password or requests a new reset email. The reset token is stored as a triple without an issua...
🚨 CVE-2026-104469
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.
🎖@cveNotify
YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki-* session cookie can reuse it after login to access private content and perform actions with the victim's privileges.
🎖@cveNotify
GitHub
YesWiki login does not regenerate the PHP session ID, enabling session fixation
### Summary
YesWiki starts a PHP session before authentication and writes the authenticated identity into the existing session during login without regenerating the session ID. If an attacker can s...
YesWiki starts a PHP session before authentication and writes the authenticated identity into the existing session during login without regenerating the session ID. If an attacker can s...
🚨 CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers.
🎖@cveNotify
GitHub
YesWiki Bazar valeur action permits page-editor SSRF and raw remote-content injection
### Summary
The Bazar `{{valeur}}` action accepts a page-authored URL, fetches that URL server-side with `/html` appended, extracts matching HTML fragments, and echoes the result without escaping. ...
The Bazar `{{valeur}}` action accepts a page-authored URL, fetches that URL server-side with `/html` appended, extracts matching HTML fragments, and echoes the result without escaping. ...
🚨 CVE-2026-104471
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
🎖@cveNotify
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
🎖@cveNotify
GitHub
YesWiki Bazar CSV import can write attacker-controlled remote files into web-accessible storage
### Summary
The Bazar CSV import preview path downloads remote URLs from file/image fields directly into the web-accessible `files/` directory without applying the normal upload extension allowlist...
The Bazar CSV import preview path downloads remote URLs from file/image fields directly into the web-accessible `files/` directory without applying the normal upload extension allowlist...
🚨 CVE-2026-104472
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retrieve confidential attachments from read-restricted pages.
🎖@cveNotify
GitHub
YesWiki attachment download handler bypasses page read ACLs
### Summary
The attachment download handler streams files attached to a page without checking whether the caller has read access to that page. An unauthenticated attacker who knows or guesses a pri...
The attachment download handler streams files attached to a page without checking whether the caller has read access to that page. An unauthenticated attacker who knows or guesses a pri...
🚨 CVE-2026-104473
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
🎖@cveNotify
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
🎖@cveNotify
GitHub
Multiple Reflected Cross Site Scripting Vulnerabilities
### Summary
Hi,
I identified multiple **reflected Cross-Site Scripting (XSS)** vulnerabilities across both **authenticated and unauthenticated** portions of the application. These findings pre...
Hi,
I identified multiple **reflected Cross-Site Scripting (XSS)** vulnerabilities across both **authenticated and unauthenticated** portions of the application. These findings pre...