Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116827YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import

Medium 6.8

In plain English

A medium-severity server-side request forgery in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.3%top 71.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.7.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-v38g-qc7g-q3mq) vendor-advisory
VulnCheck Advisory: YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import third-party-advisory