YesWiki vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116827 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated adminiHigh 8.2 · Oct 26, 2026
• CVE-2026-116826 YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to makeHigh 8.2 · Oct 26, 2026
• CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatuHigh 8.3 · Oct 26, 2026
• CVE-2026-116821 YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ High 7.1 · Oct 26, 2026
• CVE-2026-116211 YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is cHigh 8.8 · Oct 25, 2026
• CVE-2026-116208 YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manHigh 7.2 · Oct 25, 2026
• CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest()High 8.8 · Oct 25, 2026
• CVE-2026-116204 YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attaHigh 7.2 · Oct 25, 2026
• CVE-2026-104472 YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page readHigh 8.7 · Oct 2, 2026
• CVE-2026-104471 YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ diHigh 8.6 · Oct 2, 2026
• CVE-2026-104469 YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP High 7.6 · Oct 2, 2026
• CVE-2026-104467 YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API rCritical 9.2 · Oct 2, 2026
• CVE-2026-104464 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying anHigh 8.8 · Oct 2, 2026
• CVE-2026-104463 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests by sending signed FolHigh 8.3 · Oct 2, 2026
• CVE-2026-104462 YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN claHigh 8.8 · Oct 2, 2026
• CVE-2026-104460 YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXPHigh 8.7 · Oct 2, 2026
• CVE-2026-104458 YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard uHigh 8.3 · Oct 2, 2026
• CVE-2026-104457 YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatHigh 8.8 · Oct 2, 2026
• CVE-2026-104456 YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped High 7.2 · Oct 2, 2026
• CVE-2026-104450 YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chHigh 8.2 · Oct 2, 2026
• CVE-2026-104449 YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose writHigh 8.3 · Oct 2, 2026
• CVE-2026-104448 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrHigh 7.2 · Oct 2, 2026
• CVE-2026-104447 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via uHigh 7.1 · Oct 2, 2026
• CVE-2026-104445 YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activHigh 8.8 · Oct 2, 2026
• CVE-2026-104444 YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwHigh 7.1 · Oct 2, 2026