CVE-2026-105224: Yeswiki

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.

Affected products

• Yeswiki Yeswiki: before 4.6.7 (fixed in 4.6.7)

Published 2026-10-04. Last modified 2026-10-05.