YesWiki SSRF flaw CVE-2026-116827 fixed in 4.7.0
The Bazar import feature lets an administrator supply a crafted URL that makes the server reach internal addresses. A fix ships in 4.7.0.
A high-severity server-side request forgery (SSRF) vulnerability in the open-source collaboration platform YesWiki was disclosed on October 28, 2026, and registered as CVE-2026-116827 with a CVSS 4.0 score of 8.2, according to dailysecu.com.
The flaw sits in the platform's Bazar data import feature. An administrator importing an external file could enter a crafted URL that causes the server to request internal addresses it should not reach.
Successful exploitation could expose internal network services or cloud management credentials, and some responses could be written to files that are accessible from outside.
Carrying out the attack requires YesWiki administrator privileges, which limits who can trigger it.
YesWiki versions below 4.7.0 are affected. Version 4.7.0 fixes the issue, and administrators are advised to upgrade to that release.
Quick answers
Which YesWiki versions are affected by CVE-2026-116827?
All versions below 4.7.0 are affected. YesWiki 4.7.0 fixes the issue.
What can an attacker do with this YesWiki flaw?
The SSRF flaw could expose internal network services or cloud management credentials, and some responses could be saved to externally accessible files.
Does exploiting the flaw require admin access?
Yes. Exploiting the Bazar import issue requires YesWiki administrator privileges.