Medium 6.9

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows...

CVE-2026-116822 First seen on SecPulse 08:05

Affected packages

Ecosystem	Package	Affected	Fixed
YesWiki	yeswiki	< 4.7.0	4.7.0

Original description The description as published by the source.

YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Medium 6.9; CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Oct 27, 2026
First seen on SecPulse: 08:05
GHSA: GHSA-56wp-34hq-q74f
CWE: CWE-73

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Path Traversal

CWE

CWE-73

All

Yeswiki

Detection sources

NIST National Vulnerability Database09:17
GitHub Security Advisories (Global)09:33
CVE.org (CVE Program・cvelistV5)08:05