---
id: "CVE-2026-116206"
kind: "vulnerability"
aliases: ["CVE-2026-116206"]
title: "YesWiki: stored XSS in comments lets authenticated users run scripts"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["auth-required", "comments-disabled"]
published_at: "2026-10-25T14:17:01+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:42:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116206", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# YesWiki: stored XSS in comments lets authenticated users run scripts

YesWiki versions 4.2.0 through 4.6.x accept raw HTML in comment bodies through the wakka syntax, and the Twig raw filter outputs it unescaped. An authenticated user can post a comment that runs JavaScript in the sessions of administrators and other visitors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version in the wiki's package or version file: unknown whether the sources name the exact file.
- Confirm the instance runs a version from `4.2.0` up to but not including `4.7.0`.

## Fix

- Upgrade YesWiki to `4.7.0` or later.

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116206

## From the sources

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_