CVE-2026-104473 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.5.3 are susceptible to multiple reflected cross-site scripting vulnerabilities stemming from insufficient input validation on several query parameters including incomingurl, id, file, tags, and template. These flaws allow remote attackers to inject malicious JavaScript code into the application's response stream without proper sanitization or encoding of user-supplied data. The vulnerability exists because the web server processes these specific GET request parameters directly within HTML content returned to the client browser, failing to neutralize special characters that have semantic meaning in HTML and JavaScript contexts such as angle brackets, quotes, and ampersands.
The operational impact of this flaw is significant due to its reflected nature combined with social engineering vectors. An attacker can craft a malicious URL containing embedded script payloads within any of the vulnerable parameters and distribute it via phishing emails or compromised websites. When an authenticated user clicks the link, their browser executes the injected JavaScript in the context of the YesWiki domain. This execution environment grants the malicious script access to session cookies, local storage data, and the ability to perform actions on behalf of the victim using valid authentication credentials. Consequently, attackers can hijack active sessions, steal sensitive wiki content, or trigger authenticated requests against backend functionality such as editing pages, changing user settings, or modifying site configurations without further authorization checks.
From a classification perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS and specifically falls under the reflected variant where the payload is immediately returned by the web application rather than being stored for later execution. In terms of adversary tactics, this technique corresponds to ATT&CK T1059 Command and Control via Application Layer Protocol or more precisely T1189 Drive-by Client Compilation if considering browser-based exploitation techniques, though it primarily facilitates credential theft which maps to T1078 Valid Accounts when used for session hijacking. The lack of output encoding allows the script to bypass basic security controls that might otherwise mitigate simple injection attempts.
Mitigation strategies should focus on implementing strict input validation and robust output encoding mechanisms across all affected parameters. Developers must ensure that any data derived from user-controlled sources is encoded according to its context within HTML, JavaScript, or URL structures before being rendered in the response. Implementing a Content Security Policy header can also help mitigate the impact by restricting the origins from which scripts are allowed to execute, thereby preventing unauthorized code injection even if XSS vectors exist. Upgrading to version 4.5.3 or later is the primary remediation step as it addresses these specific input handling deficiencies. Additionally, enabling HttpOnly flags on session cookies can reduce the risk of session hijacking by preventing client-side scripts from accessing cookie data directly.