YesWiki CVE-2026-116822

Requires a reachable YesWiki page that contains the {{bazarliste}} action - one of the most commonly used YesWiki actions, so this is a near-default precondition on Bazar-enabled sites; no authentication and no non-default configuration are needed. The attacker appends a template GET parameter, which BazarListeAction::formatArguments() passes to Twig after only htmlspecialchars() (no basename()/hasTemplate() validation). Key LIMITING factors that cap realistic risk: impact is bounded to display manipulation of templates within the @bazar namespace (all application-managed code); Twig's validateName() blocks namespace escape and filesystem reads such as /etc/passwd; the effect is non-persistent and only reaches a victim who actually follows the crafted link; and the potential PHP path-disclosure side effect requires display_errors=On, which is off in production configurations.

This is a genuinely low-to-moderate real-world priority despite being unauthenticated and network-reachable. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) correctly reflects an easy, unauthenticated GET-parameter trigger, but the only impact is integrity-low (VI:L) - display/template manipulation - with no confidentiality (VC:N) or availability (VA:N) effect, which is why the score sits at 6.9 (medium) rather than high. The signals are mutually consistent and point away from urgency: EPSS is 0.21% (11th percentile), SSVC reports Exploitation: none, and the vulnerability is NOT in CISA KEV. SSVC Automatable: yes and Technical Impact: partial, plus the vendor advisory's own detailed curl-based proof-of-concept, mean the issue is trivially reproducible at scale - but the resulting harm is cosmetic defacement of how Bazar entries render for a visitor who follows a crafted link, not data theft or code execution. The GHSA analysis explicitly rules out filesystem reads, namespace escape (blocked by Twig validateName), code execution, and credential disclosure. The vuln.today 'this_month' label is appropriate: patch within normal cycles, not an emergency. One conflict to resolve: the aggregate metadata (EUVD/Packagist) states fixed in 4.7.0 and 'Patch: Available from vendor,' while the GHSA advisory body states no released or unreleased version fixes BazarListeAction (the hardening commit d49140452 omitted this action) - verify the actual fixed build with the vendor before marking remediated.

An unauthenticated attacker locates a YesWiki page using the very common {{bazarliste}} action, appends a crafted template GET parameter (e.g. ?template=blog) that selects an arbitrary template from the @bazar Twig namespace, and distributes that link. Any visitor following it sees the Bazar entries rendered in an unintended layout, producing defacement or confusion. A working public proof-of-concept (curl reproduction steps) is published in the vendor GHSA advisory; the input does not flag it as confirmed working exploit code.