Live › vulnerability › CVE-2026-116822
Go to dashboardYesWiki before 4.7.0 has a path traversal flaw in the BazarListeAction component, which reads the template GET parameter. An unauthenticated attacker can select arbitrary templates in the @bazar Twig namespace and force unintended page layouts, defacing pages for visitors who follow a crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
YesWiki installations before 4.7.0 that have pages using the bazarliste action are exposed, since the template parameter is read from the request URL. Sites that do not run YesWiki, or run a fixed version, can skip it. The sources do not say whether non-default configuration is needed.
No product ranges from the sources yet.
bazarliste action and check whether they accept a template parameter.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
This page as .md · .json · in your agent: get_signal("CVE-2026-116822")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.