YesWiki CVE-2026-105224

Requires an authenticated account with page-editor privileges to create or edit a page using the Bazar 'valeur' action (tools/bazar/actions/valeur.php) with its 'url' argument pointed at an attacker-controlled HTTP(S) server that returns crafted markup (e.g. a <h1 class="BAZ_fiche_titre"> block containing an <img onerror=> handler). A victim must then view the rendered page (UI:P) for the injected script to execute. Limiting factors: exploitation is gated on existing editor-level authentication (PR:L), depends on victim page views, and is neutralized once upgraded to YesWiki 4.6.7, whose patch HTML-purifies the fetched fragment and adds an SSRF guard restricting fetches to public addresses.

This is a genuine but moderate-priority stored XSS (CWE-79) in YesWiki's Bazar 'valeur' action, consistent with its medium CVSS 4.0 base score of 5.1. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) tells a coherent story: network-reachable and low complexity, but exploitation requires PR:L (an authenticated page editor) and UI:P (a victim must view the rendered page), with only Low confidentiality/integrity impact and no availability impact - hallmarks of reflected/stored script injection rather than server compromise. Exploitation status is 'no public exploit identified at time of analysis': the record is not in CISA KEV and no POC flag is present, and no EPSS probability was supplied, so widespread automated exploitation is not indicated. The requirement for existing editor privileges plus victim interaction meaningfully constrains real-world risk, making this a patch-on-normal-cycle issue rather than an emergency, though the impact scales with how many editors are untrusted and how many users view affected pages. Note the source diff shows the fix also added an SSRF guard (isUrlSafeToFetch), implying a secondary server-side-request concern not reflected in the XSS-only CVSS vector - verify scope with the vendor advisory GHSA-6rvf-7pwm-6j44.

An authenticated YesWiki user with page-editor rights adds a Bazar 'valeur' action pointing its url parameter at an attacker-controlled server that returns BAZ_fiche_titre markup containing an <img onerror=...> payload. YesWiki fetches and renders that unescaped HTML, so the injected script executes in the browser of every subsequent visitor to the page. No public exploit is identified at time of analysis, but the technique is straightforward given editor access and a reachable malicious host.