CVE-2026-116202

Versions of YesWiki before 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the bazar ImageField class, which fails to sanitize SVG file uploads. An authenticated low-privilege user can submit a malicious SVG via the entries API . Because the file is served with...

EUVD-2026-109460

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers can submit a malicious SVG via the image field of the entries API, which is served as image/svg+xml...