YesWiki CVE-2026-104473

Exploitation requires the victim to click an attacker-crafted link to the YesWiki instance containing an unsanitized script payload in one of the vulnerable parameters - incomingurl (deletepage), id and file (BazaR/GererThemes), or tags and template (listpages/bazariframe). No authentication is required per CVSS PR:N (the listpages/tags and bazariframe/template vectors are explicitly unauthenticated), though some vectors like deletepage/incomingurl are exercised in an authenticated context. The decisive limiting factor is required user interaction (UI:A): the attack cannot fire without a victim opening the malicious URL, so there is no server-side or automatable mass-exploitation path, and impact is bounded to the victim's browser session rather than direct server compromise.

This is a medium-severity reflected XSS issue (CWE-79) whose real-world priority is moderate, not urgent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless REQUIRES active user interaction (UI:A) - a victim must open an attacker-crafted link - which is the primary brake on mass exploitation. Impact is confined to the subsequent system (SC:L/SI:L) with no impact on the vulnerable system itself (VC:N/VI:N/VA:N), consistent with reflected XSS executing in the victim's browser rather than compromising the server directly. Exploitation status: publicly available exploit code exists (working PoC URLs are published in the GHSA advisory), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - PoC availability must not be conflated with in-the-wild use. The vendor advisory claims these XSS flaws can be chained toward session hijacking and potentially RCE, but that escalation depends on other, separate vulnerabilities and is not demonstrated by this CVE alone; treat the chained-RCE claim as vendor-asserted, not confirmed. CONFLICT TO VERIFY: the CVE/EUVD fixed version is 4.5.3 while the GHSA advisory states the fix is 4.6.0 - confirm the authoritative patched version with the vendor before remediating.

An attacker crafts a URL to a YesWiki instance embedding a script payload in a vulnerable parameter (e.g. incomingurl, id, file, tags, or template) and delivers it via phishing or a malicious post. When an authenticated or unauthenticated user opens the link, the reflected payload executes JavaScript in their browser session, enabling session hijacking or forged authenticated requests. Working proof-of-concept URLs are published in the GHSA advisory, lowering the barrier to weaponization.