{"id":"CVE-2026-116202","kind":"vulnerability","aliases":["CVE-2026-116202"],"related":[],"title":"YesWiki: stored XSS via unsanitized SVG uploads in bazar image field","description":"YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.","summary":"YesWiki versions before 4.7.0 accept SVG files through the bazar ImageField without sanitizing them. A low-privilege logged-in user can upload an SVG that runs script in the browser of anyone who views the entry or file.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["no-untrusted-authors","yeswiki-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin footer; versions below `4.7.0` are affected\n- Check whether accounts that can create or edit bazar entries include untrusted users","fix":"- Upgrade YesWiki to `4.7.0` or later\n- Until upgraded, restrict who can submit bazar entries with image fields","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:59+00:00","updated_at":"2026-10-25T14:42:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later\n- Until upgraded, restrict who can submit bazar entries with image fields","reach":"internet","title":"YesWiki: stored XSS via unsanitized SVG uploads in bazar image field","impact":"medium","summary":"YesWiki versions before 4.7.0 accept SVG files through the bazar ImageField without sanitizing them. A low-privilege logged-in user can upload an SVG that runs script in the browser of anyone who views the entry or file.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"Script runs in other users' browsers on the wiki, enabling session theft.","analyst_note":"","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin footer; versions below `4.7.0` are affected\n- Check whether accounts that can create or edit bazar entries include untrusted users","needs_analyst":false,"not_affected_if":["yeswiki-4.7.0-or-later","no-untrusted-authors"],"who_is_affected":"Sites running YesWiki before 4.7.0 that let users submit bazar entries with image fields are exposed. Wikis where only trusted administrators can write entries, or where image fields are not used, have less exposure. unknown whether any particular configuration is required beyond that.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3339,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116202':14A,17A '-2026':13A,16A '4.7.0':27B,66C 'accept':28B 'allow':76C 'anyon':57B 'api':105C 'attack':92C 'authent':80C 'bazar':9A,33B,89C 'browser':55B 'class':91C 'contain':67C 'cross':71C 'cross-sit':70C 'cve':12A,15A 'entri':61B,104C,119C 'execut':113C 'field':11A,101C 'file':30B,63B,86C,121C 'host':22B 'imag':10A,100C 'image/svg':110C 'imagefield':34B,90C 'log':43B 'logged-in':42B 'low':40B,78C 'low-privileg':39B,77C 'malici':96C 'packag':18B 'php':19B 'privileg':41B,79C 'run':51B 'sanit':36B 'script':52B,73C,114C 'self':21B 'self-host':20B 'serv':108C 'site':72C 'store':2A,69C 'submit':94C 'svg':6A,29B,49B,85C,97C 'unsanit':5A,84C 'upload':7A,47B,83C 'user':45B,81C,116C 'version':25B 'via':4A,98C 'view':59B,117C 'vulner':74C 'without':35B 'xml':111C 'xss':3A 'yeswiki':1A,23B,24B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki before 4.7.0 that let users submit bazar entries with image fields are exposed. Wikis where only trusted administrators can write entries, or where image fields are not used, have less exposure. unknown whether any particular configuration is required beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116202","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}