Live › vulnerability › CVE-2026-116206
Go to dashboardYesWiki versions 4.2.0 through 4.6.x accept raw HTML in comment bodies through the wakka syntax, and the Twig raw filter outputs it unescaped. An authenticated user can post a comment that runs JavaScript in the sessions of administrators and other visitors.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Any YesWiki installation from 4.2.0 before 4.7.0 where users can post comments. The attacker needs an account on the wiki, and the payload runs in the browsers of administrators and visitors who view the comment. Sites with comments disabled or with no authenticated write access are less exposed; the sources do not say more.
No product ranges from the sources yet.
4.2.0 up to but not including 4.7.0.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-116206")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.