YesWiki: Server-side request forgery in Bazar CSV import
Summary
YesWiki before 4.7.0 contains a server-side request forgery (SSRF) in the copyUrlToLocalFile() function of the Bazar CSV import. An authenticated administrator who imports a crafted CSV can make the server request internal services, cloud metadata endpoints or local files via file://. The responses are stored in the web-accessible files/ directory, where any visitor can read them. The file extension check can be bypassed with a query-string suffix or redirects.
Affected
- YesWiki versions before 4.7.0
- Confirmed affected range according to the GitHub advisory: up to 4.6.7
Fixed in
- Upgrade to YesWiki 4.7.0 or later
- Backported fixes for 4.6.x: Unknown.
Workaround
Unknown. No vendor workaround is documented.
Exploitation
- Administrator rights (PR:H) are required, with no user interaction.
- Public exploit code: none known according to OffSeq.
- Known exploitation: not known to be exploited according to OffSeq; not listed in CISA KEV according to Strix (not verified directly).
Our recommendation
- Upgrade YesWiki to 4.7.0 or later, prioritising internet-facing and cloud-hosted instances.
- Until the upgrade, limit the admin role to a minimum of named accounts.
- Restrict outbound connections from the web server and block access to cloud metadata endpoints (169.254.169.254) from the web host.
- Check the files/ directory for unexpected content and review admin accounts.
- If the server runs in a cloud VM, rotate any cloud credentials that may have been exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v38g-qc7g-q3mq github.com
- VulnCheck advisory www.vulncheck.com
- OffSeq Radar threat entry radar.offseq.com
- OpenCVE CVE-2026-116827 app.opencve.io
- ThreatInt CVE-2026-116827 cve.threatint.com
- Strix CVE-2026-116827 www.strix.ai
- YesWiki release v4.6.7 github.com
- NixOS nixpkgs tracking issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:52.
Original description (NVD)
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.