CVE-2026-116206
Deferred Deferred - Pending Action

Stored XSS in YesWiki via Comment Injection

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116206
EUVD
EUVD-2026-109464

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
YesWiki yeswiki 4.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki versions 4.2.0 to 4.7.0 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts into comment bodies using the wakka raw-HTML syntax. These scripts are not properly escaped when rendered via the Twig raw filter, allowing JavaScript execution in the sessions of administrators and visitors.

Detection Guidance

Check YesWiki installations for versions between 4.2.0 and 4.7.0. Inspect comment bodies for raw-HTML syntax or unescaped JavaScript in the /api/comments endpoint. Review Twig raw filter usage in templates.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the browsers of users who view or interact with injected comments. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of users. Administrators and visitors are both at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected YesWiki versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade YesWiki to version 4.7.0 or later. Sanitize user input in comment bodies. Disable raw-HTML syntax in comments. Apply input validation for the /api/comments endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart