{"id":"CVE-2026-116823","kind":"vulnerability","aliases":["CVE-2026-116823"],"related":[],"title":"YesWiki: crafted links inject JavaScript into pages via query parameters","description":"YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions.","summary":"YesWiki before 4.7.0 reflects unsanitized request parameters into pages through Bazar field handling and Twig raw output. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's session and perform actions as that user.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["upgraded-to-4.7.0"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; versions below `4.7.0` are affected.\n- unknown","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, avoid sending users links with unexpected query parameters and review admin sessions.","status":"open","published_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:35+00:00","updated_at":"2026-10-27T00:26:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T00:26:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until upgraded, avoid sending users links with unexpected query parameters and review admin sessions.","reach":"internet","title":"YesWiki: crafted links inject JavaScript into pages via query parameters","impact":"medium","summary":"YesWiki before 4.7.0 reflects unsanitized request parameters into pages through Bazar field handling and Twig raw output. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's session and perform actions as that user.","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs scripts in victim's session and acts as them","analyst_note":"Confirm which Bazar field paths are reachable by default and check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116823 for the affected version range and any fixed build details.","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin panel; versions below `4.7.0` are affected.\n- unknown","needs_analyst":true,"not_affected_if":["upgraded-to-4.7.0"],"who_is_affected":"Sites running YesWiki versions before 4.7.0 that render Bazar fields are affected. The sources do not say whether every installation is exposed or only those using specific Bazar forms, so the exact exposure is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3362,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116823':13A,16A '-2026':12A,15A '4.7.0':25B,67C 'action':61B,115C 'allow':77C 'attack':41B,79C,92C 'authent':114C 'back':100C 'bazar':33B,89C 'bazarfield':97C 'contain':68C 'craft':2A,49B,94C 'cross':72C 'cross-sit':71C 'cve':11A,14A 'fall':99C 'field':34B,90C 'get':43B 'getvalu':98C 'handl':35B 'host':21B 'inject':4A,81C 'javascript':5A,53B,82C 'link':3A,50B,95C 'match':87C 'miss':88C 'name':91C 'open':47B 'origin':113C 'output':39B 'packag':17B 'page':7A,31B 'paramet':10A,29B,86C 'perform':60B,110C 'php':18B 'queri':9A,85C 'raw':38B,108C 'reflect':26B,70C 'render':105C 'request':28B,103C 'run':52B 'same-origin':111C 'script':74C 'self':20B 'self-host':19B 'session':58B,118C 'site':73C 'suppli':84C 'templat':109C 'twig':37B,107C 'unauthent':78C 'unsanit':27B,102C 'user':64B 'valu':104C 'via':8A,106C 'victim':45B,56B,117C 'vulner':75C 'yeswiki':1A,22B,23B,65C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki versions before 4.7.0 that render Bazar fields are affected. The sources do not say whether every installation is exposed or only those using specific Bazar forms, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116823","severity":null,"published_at":"2026-10-27T00:17:17+00:00","modified_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}