{"id":"CVE-2026-116827","kind":"vulnerability","aliases":["CVE-2026-116827"],"related":[],"title":"YesWiki: Bazar CSV import lets admins make server-side requests to internal hosts","description":"YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.","summary":"YesWiki versions before 4.7.0 have a server-side request forgery flaw in the Bazar CSV import, where copyUrlToLocalFile() fetches URLs supplied in CSV file or image fields. An authenticated administrator can reach cloud metadata services, internal services, and local files via file://, with the responses saved in the web-accessible files/ directory.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","package","php","self-hosted","yeswiki"],"not_affected_if":["no-bazar-csv-import","yeswiki-4.7.0-or-later"],"how_to_check":"- Check the installed YesWiki version; `4.7.0` or later is not affected, anything earlier is.\n- Review admin accounts that can run the Bazar CSV import.\n- Look in the web-accessible `files/` directory for unexpected files created by imports.","fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Restrict admin accounts to those who need them and rotate any cloud credentials that may have been exposed if untrusted CSV imports ran.","status":"open","published_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","triaged_at":"2026-10-27T00:26:20+00:00","updated_at":"2026-10-27T00:26:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T00:26:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki to `4.7.0` or later.\n- Restrict admin accounts to those who need them and rotate any cloud credentials that may have been exposed if untrusted CSV imports ran.","reach":"internet","title":"YesWiki: Bazar CSV import lets admins make server-side requests to internal hosts","impact":"high","summary":"YesWiki versions before 4.7.0 have a server-side request forgery flaw in the Bazar CSV import, where copyUrlToLocalFile() fetches URLs supplied in CSV file or image fields. An authenticated administrator can reach cloud metadata services, internal services, and local files via file://, with the responses saved in the web-accessible files/ directory.","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted","cloud"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads cloud credentials and local files via server requests","analyst_note":"Check the NVD entry and the YesWiki 4.7.0 release notes to confirm the affected Bazar import paths and whether a public exploit exists.","how_to_check":"- Check the installed YesWiki version; `4.7.0` or later is not affected, anything earlier is.\n- Review admin accounts that can run the Bazar CSV import.\n- Look in the web-accessible `files/` directory for unexpected files created by imports.","needs_analyst":true,"not_affected_if":["yeswiki-4.7.0-or-later","no-bazar-csv-import"],"who_is_affected":"Self-hosted YesWiki installations before 4.7.0 that have the Bazar CSV import in use. Exposure requires an administrator account, and the risk is greatest on hosts running in cloud environments where metadata endpoints are reachable. Installations already on 4.7.0 or later, or where only trusted administrators can import, carry lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3378,"output_tokens":689,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116827':17A,20A '-2026':16A,19A '4.7.0':31B,83C 'access':78B,150C 'admin':6A 'administr':58B,102C 'allow':100C 'arbitrari':105C 'attack':118C 'authent':57B,101C 'bazar':2A,42B,94C 'bypass':120C 'check':123C 'cloud':21B,61B,134C 'contain':84C 'copyurltolocalfil':46B,97C 'craft':110C 'credenti':136C 'csv':3A,43B,51B,95C,113C 'cve':15A,18A 'directori':80B,152C 'extens':122C 'fetch':47B,133C 'field':55B,117C 'file':52B,68B,79B,114C,141C,151C 'flaw':39B 'forgeri':38B,90C 'function':98C 'host':14A,26B 'imag':54B,116C 'import':4A,44B,96C 'intern':13A,64B,137C 'let':5A 'local':67B,140C 'make':7A,104C 'metadata':62B,135C 'outbound':106C 'packag':22B 'php':23B 'queri':127C 'query-str':126C 'reach':60B 'redirect':131C 'request':11A,37B,89C,107C 'respons':72B,144C 'save':73B 'self':25B 'self-host':24B 'server':9A,35B,87C 'server-sid':8A,34B,86C 'servic':63B,65B,138C 'side':10A,36B,88C 'store':145C 'string':128C 'suffix':129C 'suppli':49B,109C 'url':48B,111C 'version':29B 'via':69B,142C 'vulner':91C 'web':77B,149C 'web-access':76B,148C 'yeswiki':1A,27B,28B,81C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted YesWiki installations before 4.7.0 that have the Bazar CSV import in use. Exposure requires an administrator account, and the risk is greatest on hosts running in cloud environments where metadata endpoints are reachable. Installations already on 4.7.0 or later, or where only trusted administrators can import, carry lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116827","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116827","severity":null,"published_at":"2026-10-27T00:17:18+00:00","modified_at":"2026-10-27T00:17:18+00:00","first_seen_at":"2026-10-27T00:25:56+00:00","fetched_at":"2026-10-27T00:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}