YesWiki: Server-side request forgery in page duplication API
Summary
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the page duplication API. An authenticated administrator can make the server request arbitrary URLs, including local files, internal services and cloud metadata endpoints. Responses are stored in the publicly accessible files/ directory, which can expose server files and database credentials. Exploitation requires administrator rights.
Affected
- YesWiki versions before 4.7.0
Fixed in
- 4.7.0 (per the vendor advisory cited by VulnCheck; verify on the advisory page before relying on it)
- Fixes for older release branches: Unknown.
Workaround
- No vendor workaround known.
- Limit the number of administrator accounts and protect them with strong, unique passwords and multi-factor authentication where possible.
- Restrict outbound connections from the web server to required destinations only.
- Make sure the files/ directory is not browsable or exposed unnecessarily.
Exploitation
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
- No public proof of concept or exploit code found; not listed in CISA KEV.
- EPSS: 0.24 % (percentile 15).
Our recommendation
- Update YesWiki to 4.7.0 or later, starting with internet-facing instances.
- Review the administrator accounts and remove unneeded ones.
- Check the files/ directory for unexpected files, such as copies of configuration files. If exposure is suspected, rotate database and cloud credentials.
- Check whether related YesWiki CVEs from the same disclosure batch (e.g. CVE-2026-116827) are covered by the same update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qmpm-85pr-3qq8 github.com
- VulnCheck advisory: YesWiki before 4.7.0 Authenticated SSRF www.vulncheck.com
- VulDB: CVE-2026-116826 vuldb.com
- OpenCVE: CVE-2026-116826 app.opencve.io
- OffSeq Radar: YesWiki SSRF radar.offseq.com
- YesWiki release v4.7.0 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:51.
Original description (NVD)
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.