CVE-2026-116822 in YesWiki
Summary
by MITRE • 10/27/2026
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
YesWiki versions prior to 4.7.0 are susceptible to a path traversal vulnerability located within the BazarListeAction component. This security flaw arises from insufficient validation of user-supplied input passed via the template GET parameter, which is intended to specify the Twig template used for rendering list views in the @bazar namespace. Because the application fails to properly sanitize or restrict this input, an unauthenticated attacker can manipulate the file path resolution mechanism to access resources outside the intended directory scope. This lack of strict boundary enforcement allows the injection of relative path sequences that bypass expected containment rules, effectively enabling the selection of arbitrary templates stored within the system's template hierarchy rather than limiting execution to approved design files.
The operational impact of this vulnerability centers on unauthorized modification of page presentation and potential defacement. By appending crafted template values to URLs containing the bazarliste action, an attacker can force the application to render pages using unintended layouts or maliciously constructed templates. This capability allows for visual manipulation of the website's appearance, leading to page defacement that is visible to any visitor who follows the manipulated link. While the primary impact described involves aesthetic disruption and integrity violation through layout alteration, such path traversal flaws often serve as a precursor to more severe attacks, including remote code execution if template files contain executable logic or can be combined with other injection vectors within the Twig environment.
From an industry standard perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which categorizes flaws where software does not properly neutralize special elements that could allow navigation outside of restricted directories. Additionally, the exploitation technique relates to ATT&CK tactic TA0043: Impact, specifically subtechniques involving defacement or disruption of service through unauthorized modification of system state. The unauthenticated nature of this access vector further highlights a failure in input validation controls, emphasizing the need for rigorous sanitization of all user-controlled parameters that influence file system operations or template rendering engines.
To mitigate this vulnerability, it is essential to implement strict allow-listing for template names rather than relying on blacklist approaches or simple string matching. Developers should ensure that only predefined, safe template identifiers are accepted by the BazarListeAction component, rejecting any input containing path traversal sequences such as dot-dot-slash characters or encoded variations thereof. Furthermore, applying principle of least privilege to file system access ensures that even if a traversal attempt succeeds, it cannot reach sensitive configuration files or executable scripts outside the designated templates directory. Regular security audits and static code analysis focused on template injection and path manipulation risks are recommended to maintain robust defenses against similar exploitation patterns in future updates.