CVE-2026-104466: YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who can edit YesWiki pages or post comments can store the malicious markdown image. The payload executes when another user views the affected content, including an administrator.
What attacker interaction is required?
The attacker needs privileges to edit a page or submit a comment, then must place quotes in a markdown image URL to break out of the src attribute and add an event handler. A victim must view the stored content for the JavaScript to execute.
Which versions are affected?
YesWiki versions before 4.6.7 are affected. The issue is in the Wakka formatter implementation at formatters/wakka.php.