Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104461YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField

Medium 5.4

In plain English

A medium-severity cross-site scripting in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 89.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.6.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-67v5-7pfv-pp9m) vendor-advisory
VulnCheck Advisory: YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField third-party-advisory