/Vulnerability Library

YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

CVE-2026-116205
Early Release

Description

YesWiki < 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.

Severity

High

CVSS Score

5.3

Affected Product

yeswiki

Published Date

October 26, 2026

Template Author

kosoyyagent

CVE-2026-116205.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-116205
CWE ID:
cwe-918

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcchttps://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntaxhttps://nvd.nist.gov/vuln/detail/CVE-2026-116205

Remediation Steps

Update to version 4.7.0 or later.