CVE-2026-116202
Deferred Deferred - Pending Action

Stored XSS in YesWiki via SVG Upload in Bazar ImageField

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116202
EUVD
EUVD-2026-109460

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YesWiki yeswiki 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.7.0 has a stored cross-site scripting (XSS) vulnerability. Low-privilege authenticated users can upload malicious SVG files through the ImageField class in the entries API. These files are not properly sanitized and are served as image/svg+xml, executing scripts when viewed by other users.

Detection Guidance

Check YesWiki versions before 4.7.0 by running: grep -r 'ImageField' /path/to/yeswiki/ | grep -v 'cleanFile()'. Inspect SVG uploads in the bazar ImageField class for unsanitized content. Look for files served as image/svg+xml with embedded scripts.

Impact Analysis

Attackers with low privileges can upload malicious SVG files that execute scripts when viewed by other users. This could lead to unauthorized actions, data theft, or session hijacking for anyone accessing the affected wiki entries or files.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations if user data is compromised through this XSS attack.

Mitigation Strategies

Upgrade YesWiki to version 4.7.0 or later. Apply cleanFile() sanitization to ImageField.php or extend the denylist to shared upload paths. Remove or sanitize existing malicious SVG files in the upload directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116202. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart