CVE-2026-104450
Deferred Deferred - Pending Action

Stored XSS in YesWiki via pointimage Action Bypass

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104450
EUVD
EUVD-2026-91461

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104450 is a missing authorization flaw in YesWiki versions before 4.6.7. It allows unauthenticated attackers to bypass write ACL checks via the pointimage action. Attackers can POST fields to any page rendering {{pointimage}} and inject raw HTML or JavaScript, causing stored cross-site scripting (XSS) in users' and administrators' browsers.

Detection Guidance

Check YesWiki versions for 4.6.6 or earlier. Inspect network traffic for POST requests to pointimage.php with pagetag, title, or description fields targeting sensitive pages. Look for unexpected HTML/JS content in rendered wiki pages.

Impact Analysis

This vulnerability enables attackers to inject malicious scripts into wiki pages. When viewed, these scripts execute in users' and administrators' browsers, potentially leading to account takeovers, data theft, or full site compromise. Attackers can target any page, including restricted ones, due to ACL bypass.

Compliance Impact

This vulnerability could violate GDPR and HIPAA by enabling unauthorized access to sensitive data through stored XSS attacks. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. A successful attack may lead to data breaches, resulting in non-compliance and potential legal penalties.

Mitigation Strategies

Upgrade YesWiki to version 4.6.7 or later. Disable allow_raw_html if not required. Implement strict ACLs to restrict write access. Remove bypass_acls=true from pointimage.php. Monitor for unauthorized page modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart