Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116205YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax

Medium 5.3

In plain English

A medium-severity server-side request forgery in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.7.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-x9j5-r988-9jcc) vendor-advisory
VulnCheck Advisory: YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax third-party-advisory