CVE-2026-116826: YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated YesWiki administrator can exploit it. The attacker must be able to submit a page-duplication request to the API endpoint.
What does an attacker need to send?
The attacker can provide file:// URLs or internal URLs through the files array in a POST request to /api/pages/{tag}/duplicate. The vulnerable downloadFile() handling then makes the outbound request.
What data could be exposed?
An attacker may retrieve local files, cloud metadata, or database credentials. Retrieved content can be stored in the publicly accessible files/ directory.
How can I determine whether an installation is affected?
YesWiki versions before 4.7.0 are affected. Review whether authenticated administrators can access the page-duplication API and whether unexpected files have been written to the public files/ directory.