YesWiki EUVD-2026-109461

Default install posture is the key enabler: on a fresh YesWiki install page ACLs are read=* and write=*, so any anonymous visitor can create/edit the page carrying the payload (the only friction is a hashcash token the page's own JS fetches without auth). The injection must ride the {{filtertags ...}} action's attribute syntax (e.g. filter1=, title, or tagbadges), which is processed before and instead of the wakka formatter's allow_raw_html gate - so it works even on the strict allow_raw_html=0 posture. Parser gates constrain the payload: filtertags splits token values on ',' and rejects values with more than one ':', and the value is echoed unquoted so it must avoid whitespace and '"' (the advisory's <img src=1 onerror=...> payload is shaped to meet all three). Execution additionally requires a victim to view the stored page (UI:P). The principal limiting factor is non-default ACLs: an instance that restricts page write/edit to authenticated users removes the anonymous-storage vector, requiring an authenticated editor instead.

Signals point to a genuine but moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) rates it 5.3 (medium): network-reachable, low complexity, no privileges, and only passive user interaction (a victim merely viewing the stored page). Impact is confined to the subsequent system - the victim's browser - with SC:L/SI:L and no impact on the vulnerable server itself (VC:N/VI:N/VA:N), which is why the score stays medium despite PR:N. The vuln.today Decision label is 'this_month', not act_now/emergency, consistent with that medium severity. The amplifying factor is deployment posture: the GHSA advisory documents a live, anonymous proof-of-concept against a default install (read=*, write=*), and notes the action-parameter path specifically defeats the allow_raw_html=0 strict posture - so the usual 'editors only' mitigation does not apply. No EPSS score and no KEV listing were provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability; absence of these is not evidence against risk, but it means urgency rests on the working PoC plus default-install exploitability, not on observed attacks. Net: a real issue worth patching this cycle, not a drop-everything emergency.

An anonymous attacker edits or creates a YesWiki page on a default-configured instance, embedding a {{filtertags filter1="..."}} action whose attribute value carries an <img onerror=...> payload that survives the parser's comma/colon/quote constraints. The malicious markup is stored unencoded and executes in the browser of every subsequent visitor, enabling session-cookie theft, defacement, or drive-by actions in an authenticated admin's session. A detailed, live-executed PoC with a working payload is published in the GHSA advisory.