YesWiki CVE-2026-116204

Exploitation requires the YesWiki default configuration as stated in the advisory: default_write_acl='*' (so any anonymous visitor can create pages), allow_raw_html=true (so the "".."" wiki construct emits attacker HTML/script verbatim without HTMLPurifier), and no restrictive Content-Security-Policy override in wakka.config.php (the default CSP sets only frame-ancestors, allowing inline script and same-origin form submission); the session cookie's SameSite=Lax permits the admin cookie on the same-site POST. The decisive limiting factor is UI:P - a logged-in administrator must view the attacker-planted wiki page for the forged request to fire (the advisory notes RecentChanges as a realistic lure). No authentication is needed to plant the payload and no browser vulnerability is required. Hardened deployments that restrict write ACLs, disable allow_raw_html, or add a strict CSP (script-src/form-action) break the self-contained exploit path. The only complete fix per the advisory is upgrading to 4.7.0.

Signals are moderately but not uniformly alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VI:H/VA:H, score 7.2) describes a network-reachable, low-complexity, unauthenticated CSRF whose impact is high integrity and high availability loss but zero confidentiality - consistent with the advisory's finding of arbitrary page deletion and revision overwrite rather than data theft. The mitigating factor is UI:P: exploitation is not self-firing against the attacker but requires a logged-in administrator to view an attacker-planted wiki page (plausible via RecentChanges, which admins monitor). vuln.today assigns a 'this_week' priority, not act_now or emergency. No EPSS score and no CISA KEV status are present in the input, so there is no quantitative exploitation-probability or confirmed-active-exploitation signal to weigh; absence of these is not evidence of low risk, only of missing data. A detailed proof of concept (HTTP requests and payload) is published inside the GHSA advisory. Overall this is a credible, fix-worthy integrity/availability flaw on default installations rather than a mass-exploited critical, with real risk bounded by the required admin interaction and dependence on default configuration (default_write_acl='*', allow_raw_html=true, permissive CSP). Priority should follow the 'this_week' decision label.

An unauthenticated attacker anonymously creates two wiki pages on a default YesWiki instance: a {{despam}} trigger page and a trap page whose body uses the "".."" raw-HTML construct to embed an auto-submitting form targeting the despam action. When an administrator later views the trap page (for example through RecentChanges), the admin's browser silently issues a same-site POST carrying the admin session cookie, causing YesWiki to delete PagePrincipale and GererConfig or restore arbitrary past revisions under the administrator's identity. A full PoC with the exact HTTP requests and decoded payload is published in the GHSA advisory.