---
id: "CVE-2026-116205"
kind: "vulnerability"
aliases: ["CVE-2026-116205"]
title: "YesWiki: unauthenticated wiki syntax lets remote users reach internal hosts"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["version-4.7.0-or-later"]
published_at: "2026-10-25T14:17:01+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116205", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# YesWiki: unauthenticated wiki syntax lets remote users reach internal hosts

YesWiki versions before 4.7.0 let an unauthenticated remote user send wiki link syntax to the page render handler so the server fetches arbitrary URLs. An attacker can use this to reach internal hosts and ports and read the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version in the wiki's package or version file; `unknown` if the sources do not name the file.
- Confirm whether the instance is reachable from the internet and whether it can reach internal hosts.

## Fix

- Upgrade YesWiki to `4.7.0` or later.
- Until upgraded, restrict outbound requests from the web server where possible.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116205

## From the sources

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_