Vulnerability Intelligence Report
YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
CVE-2026-116205
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
Nuclei Template
CVSS Base Score
6.9
MEDIUM
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-918 ↗Server-Side Request Forgery (SSRF)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| YesWiki | yeswiki | 0 < 4.7.0 (affected), 4.7.0 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Nuclei Template
SCANNER AVAILABLE
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-10-25T12:27:58 |
| Published | 2026-10-25T13:20:35 |
| Patch Date | 2026-10-09 |
| Last Updated | 2026-10-25T13:20:35 |
Community Chatter & Buzz