CVE-2026-104465 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a reflected cross-site scripting vulnerability within its email handling functionality, specifically targeting the mail handler component. This security flaw arises from insufficient input validation and sanitization of user-supplied data passed through the field parameter in HTTP requests directed at the ajax-mail-form action endpoint. The core technical deficiency lies in the application's failure to properly encode or escape special characters before rendering them back into the HTML response context, allowing malicious scripts embedded within the request parameters to be executed directly by the victim's web browser without any further interaction from the server-side logic beyond simple reflection of the input data.
The operational mechanism for exploiting this vulnerability involves an attacker crafting a specially constructed URL that includes a payload in the field parameter designed to break out of the current HTML attribute context, specifically targeting the action attribute or surrounding markup structure within the ajax-mail-form response. When an unauthenticated victim is tricked into visiting this crafted link, typically through social engineering tactics such as phishing emails or malicious websites, their browser parses the injected script and executes it in the security context of the YesWiki application domain. This execution environment grants the attacker significant capabilities to manipulate the page content, steal session cookies, capture authentication tokens, perform actions on behalf of the victim, or redirect the user to malicious sites designed for further exploitation such as credential harvesting.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under the sub-category of Reflected XSS where the payload is not stored on the server but rather reflected immediately in the response. In terms of adversary tactics, this exploitation technique maps to ATT&CK T1059 Command and Control via Application Layer Protocol for initial access or data exfiltration vectors depending on the specific script content deployed by the attacker. The lack of authentication requirements makes this vulnerability particularly dangerous as it can be exploited against any user with a valid URL, significantly lowering the barrier to entry for attackers compared to authenticated-only vulnerabilities.
To mitigate this risk, administrators must upgrade YesWiki to version 4.6.7 or later where these input validation issues have been addressed through improved sanitization routines and output encoding mechanisms. In addition to upgrading, implementing strict Content Security Policy headers can help restrict the execution of inline scripts and limit the impact if a similar vulnerability is discovered in future versions. Developers should also adopt secure coding practices that enforce context-aware output encoding for all user-controlled data rendered into HTML attributes or body content, ensuring that special characters are properly escaped regardless of their position within the markup structure to prevent attribute breakout scenarios.