CVE-2026-116827: YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated YesWiki administrator is required. The vulnerable path is the Bazar CSV import feature, where crafted URLs can be placed in CSV file or image fields.
What systems or data could be reached through the vulnerable server?
An attacker can cause YesWiki to make arbitrary outbound requests, potentially reaching cloud metadata services, internal services, or local files using file:// URLs. Retrieved responses are stored under the web-accessible files/ directory.
Can the URL validation be bypassed?
Yes. The extension check can be bypassed by using a query-string suffix or redirects, allowing crafted URLs to pass validation.
Which versions are affected?
YesWiki versions before 4.7.0 are affected.