CVE-2026-116206
CVE-2026-116206 · YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
This page contains facts from public vulnerability sources. Check the original advisory before updating.
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
yeswiki
- Versions
- ≥ 4.2.0, < 4.7.0: Affected (semver)
- 4.7.0: Not affected (semver)
Update to 4.7.0