CVE-2026-116206: YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
YesWiki versions from 4.2.0 up to, but not including, 4.7.0 are affected.
What access does an attacker need to exploit this issue?
The attacker needs an authenticated YesWiki account with the ability to submit comments. They can post a crafted comment through the /api/comments endpoint.
Who is exposed when a malicious comment is viewed?
Administrators and site visitors who view the comment can have JavaScript execute in their browser session. The issue can affect confidentiality and integrity in the context of the viewing user.
What comment content triggers the vulnerability?
The exploit uses wakka raw-HTML syntax in a comment body. That content is rendered unescaped through Twig's raw filter.