CVE-2026-104466 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the attribute to add an onerror handler, executing JavaScript in viewers' browsers, including administrators.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting vulnerability located within the formatters/wakka.php module. This security flaw arises from insufficient input validation and sanitization when processing markdown syntax for image tags. Specifically, the application fails to properly escape special characters in user-supplied data that is embedded into HTML attributes without adequate context-aware encoding. The vulnerability allows authenticated users with permissions to edit pages or post comments to inject malicious JavaScript code by manipulating the src attribute of an img tag within a markdown document. By inserting quotes and other syntactic elements, attackers can break out of the intended string boundary and append arbitrary event handlers such as onerror directly into the rendered HTML output.
The operational impact of this vulnerability is significant because it enables persistent attacks against all users who view the compromised content. Unlike reflected cross-site scripting which requires a victim to click a malicious link, stored XSS persists in the application's database or file system. Consequently, every time an administrator or another user loads the affected page or comment section, their browser executes the injected script automatically. This persistence allows attackers to steal session cookies, hijack administrative accounts, perform actions on behalf of victims, deface websites, or redirect users to malicious sites designed for phishing or further malware distribution. The ability to target administrators specifically increases the risk of full system compromise and lateral movement within the network infrastructure hosting the YesWiki instance.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. More precisely it falls under CWE-830 Inclusion of Functionality from Untrusted Control Sources when considering how user input is executed and also relates to CWE-614 Sensitive Cookie in Session Token Without Secure Flag if the attack aims at session hijacking. In terms of adversary behavior this activity maps to the ATT&CK technique T1059 Command and Scripting Interpreter specifically JavaScript execution via browser-based payloads which facilitates initial access and potentially credential harvesting through techniques like T1539 Steal Web Session Cookie or T1078 Valid Accounts if administrative privileges are obtained.
To mitigate this vulnerability organizations should immediately upgrade to YesWiki version 4.6.7 or later where the issue has been resolved by implementing robust input sanitization and output encoding mechanisms. Developers must ensure that all user-supplied data is properly escaped according to its context within HTML attributes using libraries such as OWASP Java Encoder or equivalent frameworks for PHP environments like Twig with auto-escaping enabled. Additionally adopting a strict Content Security Policy can help mitigate the impact of any remaining XSS vectors by restricting script execution sources and preventing inline scripts from running unless explicitly allowed through nonces or hashes. Regular security audits and static code analysis tools should be integrated into the development lifecycle to detect similar encoding flaws before deployment ensuring long-term resilience against injection-based attacks.