CVE-2026-116206

YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

Analysis

Technical impact

YesWiki versions 4.2.0 to 4.6.x contain a stored cross-site scripting flaw. It allows any authenticated user to inject unescaped JavaScript into comment bodies by using the wakka raw-HTML syntax on the /api/comments endpoint. The injected code is rendered through Twig's raw filter, leading to arbitrary script execution in the contexts of both administrators and other visitors who view the affected comments.

Affected Systems

Impact is limited to installations of YesWiki from version 4.2.0 through 4.6.x, as the vulnerability was patched in 4.7.0. All users of these versions, including administrators, can be affected. The affected product is YesWiki, ranging from version 4.2.0 to 4.6.x.

Risk and Exploitability

With a CVSS score of 5.3 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user who can post comments via the API, which means that attackers must first compromise a user account or gain login access. Once achieved, the stored XSS can lead to client-side attacks such as credential theft, session hijacking, or defacement, impacting confidentiality and integrity of users.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

YesWiki

yeswiki

unaffected

Version	Status	Constraints
`4.2.0`	affected	< 4.7.0
`4.7.0`	unaffected	—

No data.

Vendor Product Versions

Yeswiki

Version	Status	Scheme	Platform
`[4.2.0,4.7.0)`	affected	semver	—
`4.7.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade YesWiki to version 4.7.0 or later, which removes the raw-HTML comment feature.
If an upgrade is not yet possible, disable or remove the wakka raw-HTML syntax for comments and enforce server-side sanitization of comment input.
Restrict comment posting to trusted user roles or implement additional filtering to reject raw HTML content.
Monitor for suspicious comment activity through the /api/comments endpoint and review logs for potential abuse.

Generated by OpenCVE AI on October 25, 2026 at 17:12 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.156% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6
https://www.vulncheck.com/advisories/yeswiki-4.2.0-before-4.7.0-stored-xss-via-comment-raw-html-syntax

History

Oct 30, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 25, 2026 1:45 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.
Title		YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
First Time appeared		Yeswiki Yeswiki yeswiki
Weaknesses		CWE-79
CPEs		cpe:2.3:a:yeswiki:yeswiki::::::::
Vendors & Products		Yeswiki Yeswiki yeswiki
References		https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6 https://www.vulncheck.com/advisories/yeswiki-4.2.0-before-4.7.0-stored-xss-via-comment-raw-html-syntax
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`