CVE-2026-34598 YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter"
Attackers can inject persistent JavaScript via form titles in YesWiki, leading to code execution or account takeover when users view the page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34598?
CVE-2026-34598 is a high-severity cross-site scripting vulnerability in yeswiki, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
YesWiki is a wiki system written in PHP. Prior to version 4.6.0, a stored and blind XSS vulnerability exists in the form title field. A malicious attacker can inject JavaScript without any authentication via a form title that is saved in the backend database. When any user visits that injected page, the JavaScript payload gets executed. This issue has been patched in version 4.6.0.
Which versions are affected by CVE-2026-34598?
2 open source packages ship an affected version, including yeswiki/yeswiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.6.0 |
yeswiki/yeswiki Packagist | All versions | 4.6.0 |
Products include Yeswiki Yeswiki.
How do I fix CVE-2026-34598?
Upgrade yeswiki/yeswiki to 4.6.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-34598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34598 exists.
Other vulnerabilities in yeswiki
- CVE-2025-46348 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
- CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
- CVE-2018-1000641 Deserialization in n/a
- CVE-2025-31131 Path Traversal allowing arbitrary read of files in Yeswiki
- CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Sources
Also known as GHSA-37fq-47qj-6j5j.