{"id":"CVE-2026-116824","kind":"vulnerability","aliases":["CVE-2026-116824"],"related":[],"title":"YesWiki: stored XSS via Referer header in referrers page","description":"YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.","summary":"YesWiki before 4.7.0 stores the hostname from a crafted Referer header and renders it unescaped on the referrer-sites page. An unauthenticated attacker can run JavaScript in the browser of any user who opens that page, including logged-in administrators, and act with their same-origin rights.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["version-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version; it is affected if it is below `4.7.0`.\n- Look at handlers/page/referrers_sites.php in the install and confirm whether the Referer hostname is escaped before output.\n- Open the referrer-sites page after a test request with an HTML-containing Referer header to see if it renders unescaped (only on a test instance).","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until then, restrict who can open the referrers-sites page and review stored referrer entries for injected markup.","status":"open","published_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:36+00:00","updated_at":"2026-10-27T00:26:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Until then, restrict who can open the referrers-sites page and review stored referrer entries for injected markup.","reach":"internet","title":"YesWiki: stored XSS via Referer header in referrers page","impact":"medium","summary":"YesWiki before 4.7.0 stores the hostname from a crafted Referer header and renders it unescaped on the referrer-sites page. An unauthenticated attacker can run JavaScript in the browser of any user who opens that page, including logged-in administrators, and act with their same-origin rights.","category":"package","nicknames":[],"who_cares":["yeswiki","self-hosted","php"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs JavaScript as a victim admin and performs authenticated actions.","analyst_note":"Confirm whether the referrer-sites page is enabled by default and which roles can view it; check the NVD entry for the fixed commit or changelog.","how_to_check":"- Check the installed YesWiki version; it is affected if it is below `4.7.0`.\n- Look at handlers/page/referrers_sites.php in the install and confirm whether the Referer hostname is escaped before output.\n- Open the referrer-sites page after a test request with an HTML-containing Referer header to see if it renders unescaped (only on a test instance).","needs_analyst":true,"not_affected_if":["version-4.7.0-or-later"],"who_is_affected":"Sites running YesWiki before 4.7.0 that have the referrer-sites page in use are exposed, since the payload is stored from ordinary incoming requests and shown to whoever views that page. Staff or admins who open that page while logged in carry the most risk. Installs already on 4.7.0 or later can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000664,"input_tokens":3364,"output_tokens":655,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116824':12A,15A '-2026':11A,14A '4.7.0':24B,74C 'act':65B 'action':123C 'administr':63B 'allow':86C 'attack':45B,88C,96C 'authent':122C 'browser':51B 'contain':75C,102C 'craft':30B,93C 'cross':79C 'cross-sit':78C 'cve':10A,13A 'execut':108C 'handlers/page/referrers_sites.php':84C 'header':6A,32B,95C 'host':20B 'hostnam':27B,101C 'html':103C 'includ':59B 'inject':90C 'javascript':48B,109C 'log':61B 'logged-in':60B 'metacharact':104C 'open':56B 'origin':70B,121C 'packag':16B 'page':9A,42B,58B,115C 'perform':118C 'php':17B 'refer':5A,31B,94C,100C 'referr':8A,40B,113C 'referrer-sit':39B,112C 'render':34B,106C 'right':71B 'run':47B 'same-origin':68B,119C 'script':81C,91C 'self':19B 'self-host':18B 'send':98C 'site':41B,80C,114C 'store':2A,25B,77C 'unauthent':44B,87C 'unescap':36B,107C 'user':54B 'via':4A,92C 'visitor':116C 'vulner':82C 'xss':3A 'yeswiki':1A,21B,22B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki before 4.7.0 that have the referrer-sites page in use are exposed, since the payload is stored from ordinary incoming requests and shown to whoever views that page. Staff or admins who open that page while logged in carry the most risk. Installs already on 4.7.0 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116824","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116824","severity":null,"published_at":"2026-10-27T00:17:17+00:00","modified_at":"2026-10-27T00:17:17+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}