CVE-2026-116822 — MEDIUM (5.3)

Vulnerability Description

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-73

References

FAQ

What is CVE-2026-116822?

CVE-2026-116822 is a vulnerability with a CVSS score of 5.3 (MEDIUM). YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template G...

How severe is CVE-2026-116822?

CVE-2026-116822 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-116822?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.