Path Traversal Vulnerability in YesWiki Affects Unauthenticated Users
CVE-2026-116822

6.9MEDIUM

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116822?

A significant path traversal vulnerability exists in YesWiki before version 4.7.0, specifically in the BazarListeAction functionality. This flaw enables unauthenticated attackers to manipulate the template parameter within the @bazar Twig namespace. By appending malicious values to the template parameter in crafted requests, an attacker can force the application to render unintended template layouts. Consequently, this can lead to page defacement, impacting the experience of users accessing those pages through the crafted links. Immediate action is recommended to mitigate potential exploitation.

Affected Version(s)

yeswiki 0 < 4.7.0

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
.