Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116822YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter

Medium 5.3

In plain English

A medium-severity security flaw in yeswiki from YesWiki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.7.0

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-qfv2-x8g4-qg27) vendor-advisory
VulnCheck Advisory: YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter third-party-advisory