CVE-2026-116202 in YesWiki
Summary
by MITRE • 10/25/2026
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml and executes script for users viewing the entry or file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/25/2026
YesWiki versions prior to 4.7.0 are susceptible to a stored cross-site scripting vulnerability within the bazar ImageField class. This security flaw arises from insufficient input validation when handling uploaded files, specifically allowing low-privilege authenticated users to bypass sanitization checks and upload maliciously crafted Scalable Vector Graphics (SVG) files. The core technical deficiency lies in the application's failure to properly sanitize or validate the content of these SVG uploads before storing them on the server. Because SVG is an XML-based vector image format, it supports embedded scripting elements such as JavaScript. When a user with limited privileges submits a malicious SVG through the entries API using the designated image field, the system accepts and stores this file without stripping out executable script tags or event handlers that could trigger code execution in a client-side context.
The operational impact of this vulnerability is significant because it enables persistent attacks against other users interacting with the platform. Once the malicious SVG is uploaded, it is served by the web server with the content type image/svg+xml. When an administrator or another authenticated user views the entry containing the infected file, their browser parses the SVG and executes the embedded JavaScript code within its own security context. This results in a stored cross-site scripting scenario where the payload persists on the server rather than being transient like reflected XSS attacks. The attacker can leverage this execution to perform actions such as stealing session cookies, hijacking user sessions, performing unauthorized administrative actions on behalf of victims, or defacing web pages. Since the vulnerability requires only low-privilege authentication, it is relatively easy for an adversary to exploit after gaining initial access through phishing or credential theft.
From a classification perspective, this issue aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and more specifically CWE-436 Interpretation Conflict which occurs when different parsers interpret the same input differently leading to security bypasses. In terms of offensive cybersecurity frameworks, this vulnerability maps to MITRE ATT&CK technique T1059 Command and Control via Application Layer Protocol where attackers use legitimate services for malicious purposes, as well as T1204 User Execution if the attack relies on social engineering to get victims to view the infected entry. The persistence aspect of storing the payload in the database or file system also relates to techniques aimed at maintaining access over time without requiring repeated exploitation attempts.
Mitigation strategies should focus primarily on upgrading to YesWiki version 4.7.0 or later where this specific flaw has been addressed by developers through improved input validation and sanitization routines for SVG uploads. For organizations unable to immediately patch, implementing a web application firewall with rules capable of detecting and blocking malicious SVG content containing script tags can provide an additional layer of defense. It is also advisable to enforce strict Content Security Policy headers that restrict the execution of inline scripts within SVG contexts if possible. Additionally, administrators should review user permissions to ensure that only trusted users have access to features allowing file uploads via the entries API. Regular security audits and code reviews focusing on file upload handlers are recommended to prevent similar vulnerabilities in other parts of the application infrastructure.