CVE-2026-116827

high

Description

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory.

References

https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-ssrf-via-copyurltolocalfile-in-bazar-csv-import

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v38g-qc7g-q3mq

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110534

Details

Source: Mitre, NVD

Published: 2026-10-27

Updated: 2026-10-27

Risk Information

CVSS v2

Base Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.8

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 8.2

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00345