Stored Cross-Site Scripting Vulnerability in YesWiki by YesWiki

CVE-2026-116202

What is CVE-2026-116202?

YesWiki before version 4.7.0 is prone to a stored cross-site scripting vulnerability that permits low-privilege authenticated users to upload unsanitized SVG files. This flaw can be exploited through the bazar ImageField class in the entries API, enabling attackers to submit malicious SVG files. When these files are served with the image/svg+xml content type, scripts can be executed in the context of users viewing the entry or file, resulting in potential attacks on user sessions and sensitive data.

References