CVE-2026-116205 YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116205?
CVE-2026-116205 is a medium-severity vulnerability in yeswiki, published on 25 Oct 2026.
Official description
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
Weakness: CWE-918
Which versions are affected by CVE-2026-116205?
How do I fix CVE-2026-116205?
No fix has been published for CVE-2026-116205 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116205 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116205 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-fxcp-jrx4-gvc5, GHSA-x9j5-r988-9jcc.