CVE-2026-116822: YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
YesWiki versions before 4.7.0 are affected where a page contains the bazarliste action. The vulnerable behavior is reached through the template GET parameter for that action.
Does exploitation require authentication or user interaction?
No authentication or special privileges are required. An attacker can craft a link with a template value, and the impact occurs when visitors follow that link.
What is the practical impact of a successful exploit?
An attacker can select unintended templates within the @bazar Twig namespace, forcing an unintended page layout. This can result in page defacement for visitors using the crafted URL.