CVE-2026-104461

YesWiki versions prior to 4.6.7 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the Bazar FileField . The root cause is that the application validates only the file extension during upload and fails to call HtmlPurifierService::cleanFile, allowing SVG files to be stored ver...