CVE-2026-116206 YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax

Medium 5.3 Published 25 Oct 2026 Updated 29 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116206?

CVE-2026-116206 is a medium-severity vulnerability in yeswiki, published on 25 Oct 2026.

Official description

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

Weakness: CWE-79

Which versions are affected by CVE-2026-116206?

How do I fix CVE-2026-116206?

No fix has been published for CVE-2026-116206 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116206 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116206 exists.

Sources

Also known as GHSA-wq96-vjjh-hfc6, GHSA-xxc7-5x7q-85f3.