Stored Cross-Site Scripting in YesWiki's Bazar FileField

CVE-2026-104461

What is CVE-2026-104461?

YesWiki prior to version 4.6.7 is vulnerable to a stored cross-site scripting issue within the Bazar FileField component. This security flaw arises because the upload process only checks the file extension of uploaded files and does not utilize HtmlPurifierService::cleanFile to sanitize SVG files. Consequently, malicious SVG files can be uploaded and served directly as image/svg+xml. When these files are accessed, scripts embedded within can execute in the context of the user's session, potentially compromising administrators' accounts and leading to unauthorized access.

References