CVE-2026-105224: YesWiki before 4.6.7 Stored XSS via Bazar valeur Action
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZfichetitre markup with an img onerror handler, executing script in every viewer's browser.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page-editor privileges and must be able to configure the Bazar valeur action to fetch content from a server they control. Exploitation also requires a victim to view the affected page.
Who is exposed to the injected script?
Every user who views a page containing the malicious Bazar valeur action can have script executed in their browser. The impact crosses the privilege boundary because the injected content is rendered for other viewers.
What versions need remediation?
YesWiki versions before 4.6.7 are affected. Updating to 4.6.7 or later addresses the vulnerable behavior.
What can be done if updating is not immediately possible?
Review pages editable by untrusted or lower-privileged editors for Bazar valeur actions that reference remote URLs, especially URLs outside your control. Remove or disable actions that fetch BAZ_fiche_titre content from untrusted remote servers.