Medium severity · published Oct 26, 2026
CVE-2026-116822
YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
New
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
before 4.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116822
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116822
github.com
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qfv2-x8g4-qg27
www.vulncheck.com
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-template-traversal-via-bazarlisteaction-template-parameter
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki is a wiki system written in PHP
9.8
CVE-2025-46347
YesWiki is a wiki system written in PHP
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…