YesWiki: Missing authorization and stored XSS via pointimage action
Summary
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action, which allows unauthenticated attackers to write content to any wiki page, including pages whose write ACL restricts editing. The injected content can contain raw HTML or JavaScript, which is executed in the browsers of viewers and administrators (stored cross-site scripting). The attack requires only a wiki page that renders the pointimage markup, which is reachable by default, and no user interaction.
Affected
- YesWiki versions before 4.6.7 (the CNA record lists all versions below 4.6.7 as affected; the exact oldest affected version is unconfirmed)
- Git tags v4.4.3 to v4.6.6 are listed as affected by OSV
Fixed in
- Upgrade to YesWiki 4.6.7 or later (the vendor fix is in 4.6.7; a newer release, 4.7.0, is also reported)
Workaround
- No vendor-confirmed workaround is documented.
- Temporarily restrict anonymous POST requests to the wiki at the web server or reverse proxy level, if the site design allows it. Test first.
- Web application firewall rules may be used as a temporary measure.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'partial'.
- A public PoC reference is listed by one CVE tracker; its validity is unconfirmed.
- Not confirmed as known exploited (CISA KEV).
- EPSS 0.00265 (low predicted exploitation probability).
Our recommendation
- Inventory all YesWiki instances, their versions and whether they are reachable from the internet.
- Upgrade to 4.6.7 at minimum, or to the newest available release, as the same release fixes other related issues.
- Until patched, restrict public access to the wiki or apply WAF rules.
- Review web server logs for unexpected POST requests to the pointimage action and check wiki pages for unexpected script content.
- Verify the affected range in the GHSA advisory before the change window.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7547-q56p-h99v github.com
- VulnCheck advisory: YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action www.vulncheck.com
- OSV: CVE-2026-104450 osv.dev
- OpenCVE: CVE-2026-104450 app.opencve.io
- Vulners CVE record: CVE-2026-104450 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:22.
Original description (NVD)
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.