CVE-2026-116822 Details
Description
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
A path traversal vulnerability has been identified in YesWiki versions prior to 4.7.0, specifically within the BazarListeAction component. This vulnerability allows unauthenticated attackers to manipulate the template rendering process by selecting arbitrary templates from the @bazar Twig namespace through the template GET parameter. The exploitation of this vulnerability can lead to unintended layout changes on pages, causing defacement for users who follow the modified links.
Site administrators can override the BazarListeAction in a custom extension to add the necessary template validation, or use a web application firewall to strip the template parameter from requests to pages with Bazar listings.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qfv2-x8g4-qg27 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-template-traversal-via-bazarlisteaction-template-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |