{"id":"CVE-2026-116205","kind":"vulnerability","aliases":["CVE-2026-116205"],"related":[],"title":"YesWiki: unauthenticated wiki syntax lets remote users reach internal hosts","description":"YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.","summary":"YesWiki versions before 4.7.0 let an unauthenticated remote user send wiki link syntax to the page render handler so the server fetches arbitrary URLs. An attacker can use this to reach internal hosts and ports and read the responses.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["version-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; `unknown` if the sources do not name the file.\n- Confirm whether the instance is reachable from the internet and whether it can reach internal hosts.","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, restrict outbound requests from the web server where possible.","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:39+00:00","updated_at":"2026-10-25T14:42:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T14:42:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, restrict outbound requests from the web server where possible.","reach":"internet","title":"YesWiki: unauthenticated wiki syntax lets remote users reach internal hosts","impact":"medium","summary":"YesWiki versions before 4.7.0 let an unauthenticated remote user send wiki link syntax to the page render handler so the server fetches arbitrary URLs. An attacker can use this to reach internal hosts and ports and read the responses.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads responses from internal hosts and ports through the server","analyst_note":"Check the NVD entry and the YesWiki 4.7.0 release notes for the fix commit and any workaround before the fix line is trusted.","how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; `unknown` if the sources do not name the file.\n- Confirm whether the instance is reachable from the internet and whether it can reach internal hosts.","needs_analyst":true,"not_affected_if":["version-4.7.0-or-later"],"who_is_affected":"Any YesWiki instance below 4.7.0 that is reachable over the network is exposed, since the flaw needs no login and only the render handler. Instances on a private network with no route to internal services carry less risk, but the sources do not say which configurations are safe beyond the version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3337,"output_tokens":565,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116205':13A,16A '-2026':12A,15A '4.7.0':26B,64C 'allow':75C 'arbitrari':45B,80C 'attack':48B,77C,91C 'contain':65C 'content':98C 'cve':11A,14A 'fetch':44B,79C 'forgeri':72C 'handler':40B,90C,104C 'host':10A,21B,55B,108C 'intern':9A,54B,107C 'let':5A,27B 'link':34B 'packag':17B 'page':38B,102C 'paramet':99C 'pass':93C 'php':18B 'port':57B,110C 'reach':8A,53B,106C 'read':59B,112C 'remot':6A,30B,76C 'render':39B,89C,103C 'request':71C 'respons':61B,114C 'self':20B 'self-host':19B 'send':32B 'server':43B,69C 'server-sid':68C 'side':70C 'suppli':83C 'syntax':4A,35B,86C,95C 'unauthent':2A,29B,67C 'url':46B,81C,84C 'use':50B 'user':7A,31B 'version':24B 'vulner':73C 'wiki':3A,33B,85C 'yeswiki':1A,22B,23B,62C","nicknames":[],"mitigations":[],"who_affected":"Any YesWiki instance below 4.7.0 that is reachable over the network is exposed, since the flaw needs no login and only the render handler. Instances on a private network with no route to internal services carry less risk, but the sources do not say which configurations are safe beyond the version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116205","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116205","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}