CVE-2026-116827 json
YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
published 14d ago modified 6d ago also EUVD-2026-110534
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.
Patch / fix
- YesWiki yeswiki 4.7.0
Is CVE-2026-116827 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6d ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v38g-qc7g-q3mq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- YesWiki yeswiki
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/YesWiki/yeswiki/security/advisories/GHSA-v38g-qc7g-q3mq
vendor-advisory, exploit
-
vulncheck.com
/advisories/yeswiki-before-4.7.0-ssrf-via-copyurltolocalfile-in-bazar-csv-import
third-party-advisory
Sources
- CVE List CVE-2026-116827
- NVD CVE-2026-116827
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.