CVE-2026-116826 YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

High 8.2 Published 26 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116826?

CVE-2026-116826 is a high-severity vulnerability in yeswiki, published on 26 Oct 2026.

Official description

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.

Weakness: CWE-918

Which versions are affected by CVE-2026-116826?

How do I fix CVE-2026-116826?

No fix has been published for CVE-2026-116826 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116826 being exploited?

There is no known exploitation of CVE-2026-116826 in the wild and no public exploit code.

Sources

Also known as GHSA-4vj3-p3vv-p25q, GHSA-qmpm-85pr-3qq8.