{"id":"CVE-2026-116203","kind":"vulnerability","aliases":["CVE-2026-116203"],"related":[],"title":"YesWiki: unencoded filtertags output lets anonymous users inject stored scripts","description":"YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can inject markup via action-attribute parameters that bypasses the allow_raw_html gate, executing JavaScript for every page viewer.","summary":"YesWiki before 4.7.0 echoes attacker-controlled token values in its filtertags action without output encoding. An anonymous attacker can store markup that runs JavaScript in the browser of every visitor to the affected page.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["yeswiki-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version in the wiki's configuration or release files; versions below `4.7.0` are affected\n- Look for stored markup containing `<script` or event handlers in pages that use the filtertags action","fix":"- Upgrade YesWiki to `4.7.0` or later\n- Until upgraded, unknown whether a configuration workaround exists","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:54+00:00","updated_at":"2026-10-25T14:42:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later\n- Until upgraded, unknown whether a configuration workaround exists","reach":"internet","title":"YesWiki: unencoded filtertags output lets anonymous users inject stored scripts","impact":"medium","summary":"YesWiki before 4.7.0 echoes attacker-controlled token values in its filtertags action without output encoding. An anonymous attacker can store markup that runs JavaScript in the browser of every visitor to the affected page.","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript in every page viewer's browser","analyst_note":"Confirm the affected version range and whether a workaround exists before 4.7.0; see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116203.","how_to_check":"- Check the installed YesWiki version in the wiki's configuration or release files; versions below `4.7.0` are affected\n- Look for stored markup containing `<script` or event handlers in pages that use the filtertags action","needs_analyst":true,"not_affected_if":["yeswiki-4.7.0-or-later"],"who_is_affected":"YesWiki installations before 4.7.0 that expose the filtertags action to visitors are affected, and the description says anonymous users can reach it. Sites that do not run YesWiki can skip this. The sources do not say whether the allow_raw_html setting changes exposure beyond bypassing its gate.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3332,"output_tokens":586,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116203':13A,16A '-2026':12A,15A '4.7.0':25B,60C 'action':35B,72C,90C 'action-attribut':89C 'affect':56B 'allow':96C 'anonym':6A,40B,83C 'attack':28B,41B,76C,84C 'attacker-control':27B,75C 'attribut':91C 'browser':50B 'bypass':94C 'contain':61C 'control':29B,77C 'cross':65C 'cross-sit':64C 'cve':11A,14A 'echo':26B,74C 'encod':38B,82C 'everi':52B,103C 'execut':100C 'filtertag':3A,34B,71C 'gate':99C 'host':21B 'html':98C 'inject':8A,86C 'javascript':47B,101C 'let':5A 'markup':44B,87C 'output':4A,37B,81C 'packag':17B 'page':57B,104C 'paramet':92C 'php':18B 'raw':97C 'run':46B 'script':10A,67C 'self':20B 'self-host':19B 'site':66C 'store':9A,43B,63C 'token':30B,78C 'unencod':2A 'user':7A 'valu':31B,79C 'via':88C 'viewer':105C 'visitor':53B 'vulner':68C 'without':36B,80C 'yeswiki':1A,22B,23B,58C","nicknames":[],"mitigations":[],"who_affected":"YesWiki installations before 4.7.0 that expose the filtertags action to visitors are affected, and the description says anonymous users can reach it. Sites that do not run YesWiki can skip this. The sources do not say whether the allow_raw_html setting changes exposure beyond bypassing its gate.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116203","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}