Live › vulnerability › CVE-2026-116826
Go to dashboardYesWiki before 4.7.0 lets an authenticated administrator make the server fetch arbitrary URLs through the files array of the page duplication API. An attacker can use file:// or internal URLs to copy local files, cloud metadata or database credentials into the publicly reachable files/ directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Sites running YesWiki older than 4.7.0 where people hold administrator accounts, since the duplication endpoint is exposed to them. Hosts that run YesWiki on a network with cloud metadata endpoints or internal services are at greater risk because those become reachable from the server. Instances already on 4.7.0 or later are not affected.
No product ranges from the sources yet.
4.7.0 are affectedfiles/ directory of the web root4.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116826")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.