CVE-2026-104447
Deferred Deferred - Pending Action

Cross-Site Request Forgery in YesWiki Leading to Package Deletion

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104447
EUVD
EUVD-2026-91458

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.7 has a cross-site request forgery (CSRF) vulnerability in the autoupdate UpdateAction component. Attackers can trick a logged-in administrator into clicking a malicious link that sends an unprotected GET request to delete installed packages like extensions.

Detection Guidance

To detect this vulnerability, check if your YesWiki instance is running a version before 4.6.7. You can verify the version by examining the source code or checking the admin panel. Additionally, monitor network traffic for suspicious GET requests targeting the autoupdate UpdateAction with parameters like action=delete and a package name.

Impact Analysis

An attacker could delete critical extensions such as Bazar, disrupting core site functionality and potentially making the website unavailable. This could lead to data loss or service interruption for users.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling unauthorized modifications to a system. If an attacker deletes critical packages like Bazar, it may disrupt site functionality, potentially leading to data processing interruptions or loss of access to sensitive information. GDPR requires ensuring data integrity and availability, while HIPAA mandates protecting health data integrity. Unauthorized deletions could violate these requirements if they affect systems handling protected data.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later to patch the vulnerability. If upgrading is not possible, disable the autoupdate feature or restrict access to the UpdateAction component. Ensure CSRF protections are enforced for all state-changing actions by validating tokens and using POST requests instead of GET.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104447. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart