{"id":"CVE-2026-116822","kind":"vulnerability","aliases":["CVE-2026-116822"],"related":[],"title":"YesWiki: path traversal in BazarListeAction lets anyone pick templates","description":"YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.","summary":"YesWiki before 4.7.0 has a path traversal flaw in the BazarListeAction component, which reads the template GET parameter. An unauthenticated attacker can select arbitrary templates in the @bazar Twig namespace and force unintended page layouts, defacing pages for visitors who follow a crafted link.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; unknown whether the sources name the exact file.\n- Look for pages that use the `bazarliste` action and check whether they accept a `template` parameter.","fix":"- Upgrade YesWiki to `4.7.0` or later.","status":"open","published_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:27+00:00","updated_at":"2026-10-27T00:26:27+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.","reach":"internet","title":"YesWiki: path traversal in BazarListeAction lets anyone pick templates","impact":"low","summary":"YesWiki before 4.7.0 has a path traversal flaw in the BazarListeAction component, which reads the template GET parameter. An unauthenticated attacker can select arbitrary templates in the @bazar Twig namespace and force unintended page layouts, defacing pages for visitors who follow a crafted link.","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attackers force unintended page layouts and deface pages for visitors.","analyst_note":"","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; unknown whether the sources name the exact file.\n- Look for pages that use the `bazarliste` action and check whether they accept a `template` parameter.","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"YesWiki installations before 4.7.0 that have pages using the bazarliste action are exposed, since the template parameter is read from the request URL. Sites that do not run YesWiki, or run a fixed version, can skip it. The sources do not say whether non-default configuration is needed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000593,"input_tokens":3347,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116822':12A,15A '-2026':11A,14A '4.7.0':24B,68C 'action':105C 'allow':77C 'anyon':7A 'append':96C 'arbitrari':45B,82C 'attack':42B,79C,94C 'bazar':49B,86C 'bazarlist':104C 'bazarlisteact':5A,32B,75C 'caus':110C 'compon':33B 'contain':69C,102C 'craft':64B,97C,117C 'cve':10A,13A 'defac':57B,112C 'flaw':29B 'follow':62B,115C 'forc':53B,107C 'get':38B,92C 'host':20B 'layout':56B,109C 'let':6A 'link':65B,118C 'namespac':51B,88C 'packag':16B 'page':55B,58B,101C,111C 'paramet':39B,93C 'path':2A,27B,71C 'php':17B 'pick':8A 'read':35B 'select':44B,81C 'self':19B 'self-host':18B 'templat':9A,37B,46B,83C,91C,98C 'travers':3A,28B,72C 'twig':50B,87C 'unauthent':41B,78C 'unintend':54B,108C 'valu':99C 'via':89C 'visitor':60B,114C 'vulner':73C 'within':84C 'yeswiki':1A,21B,22B,66C","nicknames":[],"mitigations":[],"who_affected":"YesWiki installations before 4.7.0 that have pages using the bazarliste action are exposed, since the template parameter is read from the request URL. Sites that do not run YesWiki, or run a fixed version, can skip it. The sources do not say whether non-default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116822","severity":null,"published_at":"2026-10-27T00:17:17+00:00","modified_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}