YesWiki CVE-2026-104448

Exploitation requires that a user with page-deletion authority (a logged-in administrator or the page owner) has an active authenticated YesWiki session AND is lured into loading an attacker-crafted request to the ajaxdeletepage handler containing a jsonp_callback parameter; the handler deletes the page on any such GET without validating a CSRF token. The primary limiting factors are the need for victim interaction (UI:P - the privileged user must click/load the link) and the requirement that the victim already hold deletion privileges on a target page; it affects YesWiki versions before 4.6.7 and does not require the attacker to hold any credentials. Impact is limited to deletion (integrity/availability) with no confidentiality exposure.

This is a credible but context-dependent integrity/availability risk rather than a mass-exploitation emergency. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) correctly models a classic CSRF: the attacker themselves needs no credentials (PR:N), but exploitation hinges on passive user interaction (UI:P) - a logged-in administrator or page owner must visit a crafted link while their YesWiki session is active. Impact is scoped to data destruction (VI:H/VA:H, no confidentiality impact VC:N), consistent with CWE-352 and the described permanent page deletion. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the finding comes from VulnCheck research with a vendor advisory (GHSA-hqmg-843g-pp28) and an available patch. The signals are internally consistent - no CVSS-vs-description conflict - but the dependence on tricking a privileged, authenticated user and the low real-world footprint of YesWiki argue against treating this as a widespread priority. It should be patched promptly on exposed YesWiki instances, especially multi-user/public wikis with external-facing admins.

An attacker crafts a malicious web page or email link pointing at the victim YesWiki instance's ajaxdeletepage handler with a jsonp_callback parameter. They lure a logged-in administrator or page owner into clicking it; because the handler performs the deletion on a GET request without validating a CSRF token, the target page - and its ACLs, links, triples, comments, and referrers - is permanently removed using the victim's session. No public exploit code is identified at time of analysis, but the attack requires no special tooling and succeeds while the victim remains authenticated.