{"id":"CVE-2026-116826","kind":"vulnerability","aliases":["CVE-2026-116826"],"related":[],"title":"YesWiki: admin SSRF in page duplication reads local files and metadata","description":"YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.","summary":"YesWiki before 4.7.0 lets an authenticated administrator make the server fetch arbitrary URLs through the files array of the page duplication API. An attacker can use file:// or internal URLs to copy local files, cloud metadata or database credentials into the publicly reachable files/ directory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","yeswiki"],"not_affected_if":["auth-required","patched-version"],"how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin page; versions below `4.7.0` are affected\n- Look for unexpected copied files under the `files/` directory of the web root","fix":"- Upgrade YesWiki to `4.7.0` or later\n- Rotate database credentials and any cloud or internal secrets reachable from the server if the instance was exposed to untrusted administrators","status":"open","published_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:20+00:00","updated_at":"2026-10-27T00:26:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later\n- Rotate database credentials and any cloud or internal secrets reachable from the server if the instance was exposed to untrusted administrators","reach":"internet","title":"YesWiki: admin SSRF in page duplication reads local files and metadata","impact":"high","summary":"YesWiki before 4.7.0 lets an authenticated administrator make the server fetch arbitrary URLs through the files array of the page duplication API. An attacker can use file:// or internal URLs to copy local files, cloud metadata or database credentials into the publicly reachable files/ directory.","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Server-side files and internal secrets are copied to a public directory","analyst_note":"Confirm the affected version range and whether the vendor advisory lists a fixed release beyond 4.7.0 at the NVD link.","how_to_check":"- Check the installed YesWiki version in the wiki's version file or admin page; versions below `4.7.0` are affected\n- Look for unexpected copied files under the `files/` directory of the web root","needs_analyst":true,"not_affected_if":["auth-required","patched-version"],"who_is_affected":"Sites running YesWiki older than 4.7.0 where people hold administrator accounts, since the duplication endpoint is exposed to them. Hosts that run YesWiki on a network with cloud metadata endpoints or internal services are at greater risk because those become reachable from the server. Instances already on 4.7.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":3358,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116826':14A,17A '-2026':13A,16A '/api/pages':102C '/duplicate':104C '4.7.0':26B,70C 'access':116C 'admin':2A 'administr':30B,85C 'allow':83C 'api':45B 'arbitrari':35B,88C 'array':40B,94C 'attack':47B,95C 'authent':29B,84C 'cloud':57B,108C 'contain':71C 'copi':54B 'credenti':61B,112C 'cve':12A,15A 'databas':60B,111C 'directori':67B,118C 'downloadfil':81C 'duplic':6A,44B 'duplicationmanag':80C 'fetch':34B 'file':9A,39B,56B,66B,93C,107C,117C 'forgeri':77C 'host':22B 'intern':51B,99C 'let':27B 'local':8A,55B,106C 'make':31B,87C 'metadata':11A,58B,109C 'outbound':89C 'packag':18B 'page':5A,43B 'php':19B 'post':97C 'public':64B,115C 'reachabl':65B 'read':7A 'request':76C,90C 'self':21B 'self-host':20B 'server':33B,74C 'server-sid':73C 'side':75C 'ssrf':3A 'store':105C 'tag':103C 'url':36B,52B,100C 'use':49B 'via':91C 'vulner':78C 'yeswiki':1A,23B,24B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running YesWiki older than 4.7.0 where people hold administrator accounts, since the duplication endpoint is exposed to them. Hosts that run YesWiki on a network with cloud metadata endpoints or internal services are at greater risk because those become reachable from the server. Instances already on 4.7.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116826","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116826","severity":null,"published_at":"2026-10-27T00:17:18+00:00","modified_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}