CVE-2026-116202

Versions of YesWiki before 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the bazar ImageField class, which fails to sanitize SVG file uploads. An authenticated low-privilege user can submit a malicious SVG via the entries API . Because the file is served with...