CVE-2026-116205

CVSS 6.9 (medium) · published 2026-10-25

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.

Weakness: CWE-918

Source: NVD CVE-2026-116205

References

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc
• https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.