CVE-2026-104473 YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages
Remote attackers can inject JavaScript via unsanitized parameters in YesWiki, allowing session hijacking and unauthorized actions against backend functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-104473?
CVE-2026-104473 is a medium-severity cross-site scripting vulnerability in yeswiki, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted links to hijack sessions and trigger authenticated requests against backend functionality.
Weakness: CWE-79
Which versions are affected by CVE-2026-104473?
2 open source packages ship an affected version, including yeswiki/yeswiki.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.6.0 |
yeswiki/yeswiki Packagist | All versions | 4.6.0 |
How do I fix CVE-2026-104473?
Upgrade yeswiki/yeswiki to 4.6.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-104473 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104473 exists.
Sources
Also known as GHSA-5724-x3rh-5qqq, GHSA-8mcv-55p8-4xgh.