---
id: "CVE-2026-116827"
kind: "vulnerability"
aliases: ["CVE-2026-116827"]
title: "YesWiki: Bazar CSV import lets admins make server-side requests to internal hosts"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cloud", "package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["no-bazar-csv-import", "yeswiki-4.7.0-or-later"]
published_at: "2026-10-27T00:17:18+00:00"
first_seen_at: "2026-10-27T00:25:56+00:00"
updated_at: "2026-10-27T00:26:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116827", "first_seen_at": "2026-10-27T00:25:56+00:00"}]
---

# YesWiki: Bazar CSV import lets admins make server-side requests to internal hosts

YesWiki versions before 4.7.0 have a server-side request forgery flaw in the Bazar CSV import, where copyUrlToLocalFile() fetches URLs supplied in CSV file or image fields. An authenticated administrator can reach cloud metadata services, internal services, and local files via file://, with the responses saved in the web-accessible files/ directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version; `4.7.0` or later is not affected, anything earlier is.
- Review admin accounts that can run the Bazar CSV import.
- Look in the web-accessible `files/` directory for unexpected files created by imports.

## Fix

- Upgrade YesWiki to `4.7.0` or later.
- Restrict admin accounts to those who need them and rotate any cloud credentials that may have been exposed if untrusted CSV imports ran.

## Timeline

- 2026-10-27T00:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116827

## From the sources

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_