Technical impact
YesWiki prior to version 4.7.0 allows a low‑privilege authenticated user to upload an SVG file that is delivered as an image/svg+xml response and executed by browsers that view the entry or the file, resulting in stored cross‑site scripting. The vulnerability stems from insufficient sanitization of the SVG content in the ImageField API, enabling arbitrary client‑side script injection. Attackers can place malicious JavaScript inside the SVG, which will run in the context of any user who opens the entry or the file, potentially enabling session hijacking or defacement.
Affected Systems
Vulnerable systems are deployments of YesWiki (yeswiki:yeswiki) with any version earlier than 4.7.0. Users of these installations with permission to add or edit entries can upload the malicious SVG. The issue does not affect newer releases that implement proper validation.
Risk and Exploitability
The CVSS base score of 5.1 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a comparatively low exploitation probability at present. However, the attack requires only authenticated access with upload rights, which is a common privilege level on community sites. Because the flaw is a stored XSS, the impact is limited to confidentiality, integrity and availability of the user’s browsing session; it does not grant remote code execution on the host. The moderate severity and the fact that exploitation requires moderate privileges recommend urgent patching.
