CVE-2026-116204: YesWiki before 4.7.0 CSRF via despam Admin Action
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
YesWiki instances running versions before 4.7.0 are exposed when an administrator can be induced to view a wiki page containing an attacker-planted auto-submitting HTML form.
What does an attacker need to exploit it?
The attacker does not need authentication, but must place a crafted raw HTML form on a wiki page and cause an administrator to view that page. The administrator's active session is then used to submit despam action parameters.
What impact can exploitation have?
An attacker can cause pages to be deleted or restored, including PagePrincipale and configuration pages, or overwrite current page content. The described requests use clean, suppr[], or rev[] parameters.
Are default deployments affected?
The available information identifies affected versions as YesWiki before 4.7.0, but does not state whether any additional configuration or feature setting is required beyond an administrator viewing the malicious wiki page.