CVE-2026-116202: YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A low-privilege authenticated YesWiki user can exploit it. They need access to submit content through the entries API and upload a file via a bazar ImageField.
What user interaction is required for impact?
A victim must view the affected entry or uploaded file. The malicious SVG is served as image/svg+xml, allowing its script to execute in the viewer's browser.
Are default installations affected?
The available information does not establish whether ImageField uploads through the entries API are enabled or reachable in a default installation. Exposure depends on whether authenticated users can submit SVG files through a bazar ImageField.
What should be done if upgrading is not immediately possible?
Restrict low-privilege users' ability to submit files through bazar ImageField entries and prevent SVG uploads where possible. Review existing ImageField uploads and entries for untrusted SVG files, since uploaded payloads may execute when viewed.
How can administrators determine whether they may already be affected?
Check whether the YesWiki instance is running a version before 4.7.0 and whether low-privilege authenticated users can upload SVG files through the entries API's bazar ImageField. Review previously uploaded SVG files and the entries that reference them.