YesWiki before 4.6.7 stores uploaded SVG files without sanitization, serving them inline as image/svg+xml. An attacker who is able to authenticate to the site can submit a crafted SVG via POST /api/entries/{formId}. The SVG may contain embedded scripts that execute in the context of the wiki origin when the file is viewed, giving the attacker the power to run arbitrary code as the administrator or compromise an administrator’s session.

The vulnerability affects all installations of YesWiki with a version earlier than 4.6.7. It is present in the YesWiki product, which is identified by the CNA as yeswiki:yeswiki.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an authenticated user to upload a malicious SVG file, so the exploit can occur only when the attacker has legitimate access credentials. Once the SVG is displayed by a user, the embedded script runs with the privileges of that user, potentially allowing compromise of administrator accounts if the script can elevate privileges or hijack sessions.