CVE-2026-104448: YesWiki before 4.6.7 CSRF Page Deletion via ajaxdeletepage Handler
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonpcallback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
Affected Software
Event History
Frequently Asked Questions
Which YesWiki installations are affected?
YesWiki versions before 4.6.7 are affected. Installations running 4.6.7 or later are not identified as affected by this vulnerability.
What must occur for an attacker to trigger page deletion?
An attacker must lure a logged-in administrator or page owner into opening a crafted link. The attacker does not need privileges on the target YesWiki instance.
What data is removed if exploitation succeeds?
The targeted page is permanently deleted along with its ACLs, links, triples, comments, and referrers.