{"id":"CVE-2026-116206","kind":"vulnerability","aliases":["CVE-2026-116206"],"related":[],"title":"YesWiki: stored XSS in comments lets authenticated users run scripts","description":"YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.","summary":"YesWiki versions 4.2.0 through 4.6.x accept raw HTML in comment bodies through the wakka syntax, and the Twig raw filter outputs it unescaped. An authenticated user can post a comment that runs JavaScript in the sessions of administrators and other visitors.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["auth-required","comments-disabled"],"how_to_check":"- Check the installed YesWiki version in the wiki's package or version file: unknown whether the sources name the exact file.\n- Confirm the instance runs a version from `4.2.0` up to but not including `4.7.0`.","fix":"- Upgrade YesWiki to `4.7.0` or later.","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:47+00:00","updated_at":"2026-10-25T14:42:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T14:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.","reach":"internet","title":"YesWiki: stored XSS in comments lets authenticated users run scripts","impact":"medium","summary":"YesWiki versions 4.2.0 through 4.6.x accept raw HTML in comment bodies through the wakka syntax, and the Twig raw filter outputs it unescaped. An authenticated user can post a comment that runs JavaScript in the sessions of administrators and other visitors.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker script runs in admin sessions, enabling account takeover.","analyst_note":"","how_to_check":"- Check the installed YesWiki version in the wiki's package or version file: unknown whether the sources name the exact file.\n- Confirm the instance runs a version from `4.2.0` up to but not including `4.7.0`.","needs_analyst":false,"not_affected_if":["auth-required","comments-disabled"],"who_is_affected":"Any YesWiki installation from 4.2.0 before 4.7.0 where users can post comments. The attacker needs an account on the wiki, and the payload runs in the browsers of administrators and visitors who view the comment. Sites with comments disabled or with no authenticated write access are less exposed; the sources do not say more.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3354,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116206':13A,16A '-2026':12A,15A '/api/comments':101C '4.2.0':25B,67C '4.6':27B '4.7.0':69C 'accept':29B 'administr':61B,114C 'allow':79C 'attack':95C 'authent':7A,48B,80C 'bodi':34B,87C 'comment':5A,33B,53B,86C,98C 'contain':70C 'cross':74C 'cross-sit':73C 'cve':11A,14A 'endpoint':102C 'execut':111C 'filter':43B,110C 'host':21B 'html':31B,93C 'inject':83C 'javascript':56B,112C 'let':6A 'output':44B 'packag':17B 'php':18B 'post':51B,97C 'raw':30B,42B,92C,109C 'raw-html':91C 'render':104C 'run':9A,55B 'script':10A,76C,84C 'self':20B 'self-host':19B 'session':59B,117C 'site':75C 'store':2A,72C 'syntax':38B,94C 'twig':41B,108C 'unescap':46B,105C 'use':88C 'user':8A,49B,81C 'version':24B 'via':99C 'visitor':64B,116C 'vulner':77C 'wakka':37B,90C 'x':28B 'xss':3A 'yeswiki':1A,22B,23B,65C","nicknames":[],"mitigations":[],"who_affected":"Any YesWiki installation from 4.2.0 before 4.7.0 where users can post comments. The attacker needs an account on the wiki, and the payload runs in the browsers of administrators and visitors who view the comment. Sites with comments disabled or with no authenticated write access are less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116206","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}