Vulnerability Description
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc
- https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-v
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc
FAQ
What is CVE-2026-116205?
CVE-2026-116205 is a vulnerability with a CVSS score of 5.3 (MEDIUM). YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler....
How severe is CVE-2026-116205?
CVE-2026-116205 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116205?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.