---
id: "CVE-2026-116822"
kind: "vulnerability"
aliases: ["CVE-2026-116822"]
title: "YesWiki: path traversal in BazarListeAction lets anyone pick templates"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["fixed-version"]
published_at: "2026-10-27T00:17:17+00:00"
first_seen_at: "2026-10-27T00:25:56+00:00"
updated_at: "2026-10-27T00:26:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116822", "first_seen_at": "2026-10-27T00:25:56+00:00"}]
---

# YesWiki: path traversal in BazarListeAction lets anyone pick templates

YesWiki before 4.7.0 has a path traversal flaw in the BazarListeAction component, which reads the template GET parameter. An unauthenticated attacker can select arbitrary templates in the @bazar Twig namespace and force unintended page layouts, defacing pages for visitors who follow a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version in the wiki's version file or admin panel; unknown whether the sources name the exact file.
- Look for pages that use the `bazarliste` action and check whether they accept a `template` parameter.

## Fix

- Upgrade YesWiki to `4.7.0` or later.

## Timeline

- 2026-10-27T00:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116822

## From the sources

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_