CVE-2026-105224 in YesWiki
Summary
by MITRE • 10/04/2026
YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/04/2026
The vulnerability identified in YesWiki versions prior to 4.6.7 represents a significant security flaw within the Bazaar module, specifically affecting the valeur action component. This issue stems from improper input validation and output encoding practices when handling data retrieved from external sources. The core technical failure lies in the application's decision to render HTML content fetched from remote URLs without sufficient sanitization or escaping mechanisms. When an authenticated page editor utilizes this functionality, they can manipulate the source of the fetched content by pointing it toward a server under their control. This allows for the injection of malicious script payloads that are subsequently executed within the context of other users' browsers who view the affected pages.
From a technical perspective, the exploitation vector relies on the interaction between the Bazaar module's data fetching capabilities and its rendering engine. The attacker configures a remote server to return specific markup, notably utilizing the BAZ_fiche_titre structure which includes an img tag with an onerror event handler. Because YesWiki fails to escape this HTML content before displaying it in the browser context, the malicious script embedded within the error handling attribute is executed by any user who loads the page containing this injected content. This constitutes a stored cross-site scripting vulnerability because the payload persists on the server and affects multiple victims over time rather than being limited to a single session or request as seen in reflected XSS scenarios.
The operational impact of this vulnerability extends beyond simple script execution, potentially leading to severe compromises of user sessions and data integrity. An attacker can leverage this capability to steal sensitive information such as authentication cookies, session tokens, or personal data displayed on the page. Furthermore, the malicious scripts could perform actions on behalf of the victim, including modifying content, redirecting users to phishing sites, or spreading malware through drive-by downloads. Since the vulnerability requires only page editor privileges rather than full administrative access, it lowers the barrier for exploitation and increases the likelihood of successful attacks within environments where multiple trusted editors contribute content.
This flaw aligns with CWE-79, which categorizes improper neutralization of input during web page generation as a cross-site scripting weakness. The attack pattern corresponds to ATT&CK technique T1059.007, specifically JavaScript execution on the client side, and can be used in conjunction with data exfiltration techniques like T1005 for stealing browser-stored information. To mitigate this risk, it is imperative that organizations running YesWiki upgrade immediately to version 4.6.7 or later where these encoding issues have been addressed. Additionally, implementing a Content Security Policy (CSP) can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute. Developers should also enforce strict output encoding for all dynamic content and validate remote URLs against allowlists to prevent unauthorized data fetching that could lead to similar injection attacks in other parts of the application.