Unauthenticated SSRF Vulnerability in YesWiki by YesWiki Team
CVE-2026-116205

6.9MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116205?

YesWiki prior to version 4.7.0 is vulnerable to an unauthenticated server-side request forgery (SSRF) flaw, allowing remote attackers to exploit internal network services. By leveraging a particular syntax in the content parameter of the page render handler, attackers can send crafted requests to internal resources, potentially disclosing sensitive data or gaining insights into the internal network structure. This vulnerability emphasizes the importance of strict input validation and access controls to safeguard web applications from unauthorized remote interactions.

Affected Version(s)

yeswiki 0 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

M7Saad
.