CVE-2026-116824 Details
Description
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions.
A stored cross-site scripting vulnerability has been identified in YesWiki versions prior to 4.7.0. The issue resides in the referrers_sites.php handler, where unescaped HTTP Referer hostnames are rendered into HTML anchor tags. This flaw allows unauthenticated attackers to inject scripts by sending crafted Referer headers. The injected JavaScript executes automatically for any visitor of the referrer-sites page, enabling the attacker to perform same-origin authenticated actions on behalf of the user.
Users can update to YesWiki version 4.7.0 or later, where this vulnerability has been patched. As an interim measure, access to the referrers_sites handler can be restricted via the handler ACL configuration, or referrer logging can be disabled by setting the referrers_purge_time option to 0 in the wiki configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xcwg-2pj5-3qm4 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xcwg-2pj5-3qm4 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-referer-header-in-referrers-sites-handler | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |