---
id: "CVE-2026-116826"
kind: "vulnerability"
aliases: ["CVE-2026-116826"]
title: "YesWiki: admin SSRF in page duplication reads local files and metadata"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["auth-required", "patched-version"]
published_at: "2026-10-27T00:17:18+00:00"
first_seen_at: "2026-10-27T00:25:56+00:00"
updated_at: "2026-10-27T00:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116826", "first_seen_at": "2026-10-27T00:25:56+00:00"}]
---

# YesWiki: admin SSRF in page duplication reads local files and metadata

YesWiki before 4.7.0 lets an authenticated administrator make the server fetch arbitrary URLs through the files array of the page duplication API. An attacker can use file:// or internal URLs to copy local files, cloud metadata or database credentials into the publicly reachable files/ directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version in the wiki's version file or admin page; versions below `4.7.0` are affected
- Look for unexpected copied files under the `files/` directory of the web root

## Fix

- Upgrade YesWiki to `4.7.0` or later
- Rotate database credentials and any cloud or internal secrets reachable from the server if the instance was exposed to untrusted administrators

## Timeline

- 2026-10-27T00:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116826

## From the sources

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_