Live › vulnerability › CVE-2026-116202
Go to dashboardYesWiki versions before 4.7.0 accept SVG files through the bazar ImageField without sanitizing them. A low-privilege logged-in user can upload an SVG that runs script in the browser of anyone who views the entry or file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Sites running YesWiki before 4.7.0 that let users submit bazar entries with image fields are exposed. Wikis where only trusted administrators can write entries, or where image fields are not used, have less exposure. unknown whether any particular configuration is required beyond that.
No product ranges from the sources yet.
4.7.0 are affected4.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.
This page as .md · .json · in your agent: get_signal("CVE-2026-116202")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.