CVE-2026-116206

YesWiki versions 4.2.0 before 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the use of the Twig raw filter to render comments submitted via the /api/comments endpoint, which allows authenticated users to inject scripts using wakka raw-HTML syntax . This can r...