CVE-2026-104448: Yeswiki

High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days.

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.

Affected products

• Yeswiki Yeswiki: before 4.6.7 (fixed in 4.6.7)

Published 2026-10-02. Last modified 2026-10-02.