YesWiki CVE-2026-116827

Requires an authenticated administrator account (PR:H) and a Bazar form containing a file- or image-type field; the BazarImportAction ({{bazarimport}}) is enabled by default and guarded only by admin-level checkSecuredACL(). The attacker supplies a URL in a CSV file/image column, which reaches curl_init() unfiltered (CURLPROTO_ALL, CURLOPT_FOLLOWLOCATION=true, CURLOPT_SSL_VERIFYPEER=false), allowing file://, gopher://, dict:// and HTTP(S) targets. The filename-extension allowlist is bypassed either via the '?.ext' parser differential (PHP basename() treats '?' literally while curl treats it as a query separator) or via redirect chains. Highest impact occurs on cloud deployments (AWS/GCP/Azure) where the 169.254.169.254 metadata endpoint exposes IAM credentials; the response is stored in the web-accessible files/ directory and retrievable by any unauthenticated visitor at a predictable URL. Principal limiting factor: the admin privilege requirement - this is not exploitable by anonymous or low-privilege users.

Signals point to a serious-but-gated vulnerability rather than a mass-exploitation emergency. The CVSS 4.0 base score is 8.2 (High) driven by network vector, low complexity, no user interaction, high confidentiality impact and a scope/subsequent-system change (VC:H/SC:H) - appropriate for an SSRF that reaches cloud IAM metadata and internal services. However, PR:H means exploitation requires an authenticated administrator, which sharply narrows the realistic attacker population and is the single biggest mitigating factor. EPSS is low at 0.34% (28th percentile), consistent with an admin-gated flaw in a niche product and with the absence of a CISA KEV listing - there is no confirmed active exploitation. A detailed public proof-of-concept exists in the GHSA advisory (CSV payload plus retrieval command), so the barrier to weaponization is low for anyone who already holds admin. The vuln.today 'this_week' decision label reflects a credible, well-documented issue that warrants prompt patching but not drop-everything emergency handling. Net: this is a real priority for any YesWiki instance running on a cloud provider with instance-metadata credentials, but the admin precondition keeps it well below internet-wide critical risk. Note one data conflict to verify: the top-level input and the GHSA summary line state a fix in 4.7.0, while the GHSA body text states 'no fix exists on any branch' as of the v4.6.7 checkout - confirm the actual fixed build with the vendor.

An authenticated YesWiki administrator (or an attacker who has obtained admin credentials) uploads a crafted CSV to a Bazar form's import action, placing a URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/role?.json in a file- or image-type column. The server fetches the URL via copyUrlToLocalFile() with no SSRF filtering and stores the full response - including cloud IAM credentials - in the web-accessible files/ directory, where any unauthenticated visitor can retrieve it. A step-by-step public PoC demonstrating exactly this is published in the GHSA advisory; it is a documented reproduction rather than a verified standalone exploit tool.