CVE-2026-116203: YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allowrawhtml gate, executing JavaScript for every page viewer.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Anonymous attackers can exploit it; no prior authentication is required. They can inject markup through action-attribute parameters handled by the filtertags action.
What conditions are needed for successful exploitation?
Exploitation requires an attacker to supply crafted action-attribute parameters and a victim to view a page containing the stored payload. The issue bypasses the allow_raw_html gate.
Who is affected by a successful attack?
JavaScript can execute in the browser of every user who views a page containing the attacker’s stored payload. The reported impact includes confidentiality and integrity effects.
Which versions are affected?
YesWiki versions before 4.7.0 are affected. Upgrading to 4.7.0 or later removes the affected version range described in the advisory.