CVE-2026-104450: YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Any YesWiki deployment before 4.6.7 is exposed if it has a page that renders the {{pointimage}} action. An attacker does not need an account and can target pages even when their normal write ACLs restrict editing.
What must an attacker do to exploit this issue?
The attacker must send a POST request containing pagetag, title, and description fields to the pointimage action for a page rendering {{pointimage}}. The submitted content can append raw HTML or JavaScript to the selected wiki page.
What is the impact of a successful attack?
Injected content is stored on the targeted page and executes in the browsers of people who view it, including administrators. This can compromise confidentiality and integrity in those users' browser sessions.
How can I determine whether a page may have been affected?
Review pages that render {{pointimage}} for unexpected appended content, especially raw HTML or JavaScript. Also inspect submissions to the pointimage action for unauthenticated POST requests containing pagetag, title, or description fields.