Live › vulnerability › CVE-2026-116827
Go to dashboardYesWiki versions before 4.7.0 have a server-side request forgery flaw in the Bazar CSV import, where copyUrlToLocalFile() fetches URLs supplied in CSV file or image fields. An authenticated administrator can reach cloud metadata services, internal services, and local files via file://, with the responses saved in the web-accessible files/ directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 00:25 UTC. All times on this page are UTC.
Self-hosted YesWiki installations before 4.7.0 that have the Bazar CSV import in use. Exposure requires an administrator account, and the risk is greatest on hosts running in cloud environments where metadata endpoints are reachable. Installations already on 4.7.0 or later, or where only trusted administrators can import, carry lower risk.
No product ranges from the sources yet.
4.7.0 or later is not affected, anything earlier is.files/ directory for unexpected files created by imports.4.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-116827")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.