CVE-2026-116826 Details
Description
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
A server-side request forgery (SSRF) vulnerability has been identified in YesWiki versions prior to 4.7.0, specifically within the DuplicationManager::downloadFile() method of the page duplication API. This vulnerability allows authenticated administrators to make arbitrary outbound requests by manipulating the files array in the API request. Exploitation involves sending crafted URLs, including file:// or internal links, which can result in the unauthorized access of local files, cloud metadata, or database credentials. The retrieved data is then stored in the publicly accessible files directory without any restrictions on file extensions.
Users are advised to update YesWiki to version 4.7.0 or later, where this vulnerability has been patched. As an interim measure, administrators should restrict API access to trusted networks and monitor outbound connections from the web server process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qmpm-85pr-3qq8 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-authenticated-ssrf-via-page-duplication-api-downloadfile | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |