YesWiki EUVD-2026-110531

No authentication is required to inject (PR:N): the referrers_sites handler's default ACL is '*' (everyone), and the attacker fully controls the Referer value, which passes the only guards - a '^https?://' scheme check and a same-origin exclusion - using a different host that still begins with 'http://'. The concrete prerequisite for payload execution is that a user must visit the specific '?PageName/referrers_sites' handler view (UI:P); until then the stored payload is dormant. The payload persists for up to 24 days by default (referrers_purge_time) and no Content Security Policy restricts inline script (only frame-ancestors is set). Limiting factors: direct session-cookie theft is blocked because cookies are HttpOnly (YesWikiInit.php:410), so impact is constrained to same-origin fetch/XHR actions and content exfiltration in the visitor's context; and the target must be a YesWiki instance before 4.7.0 with referrer logging enabled (not set to referrers_purge_time 0).

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N, score 5.3) describes a network-reachable, low-complexity, unauthenticated stored XSS whose impact is bounded to Low confidentiality/integrity on both the vulnerable and a subsequent system, with no availability impact - consistent with a persistent XSS that runs in a visitor's browser rather than compromising the server. The UI:P element is the key limiter: the payload only fires when a user loads the referrer-sites page. EPSS is low at 0.18% (7th percentile), and the CVE is NOT in CISA KEV, so there is no public evidence of active exploitation; the signals are therefore aligned rather than conflicting - a low real-world exploitation probability for a niche product. The vuln.today decision label is 'this_month' (not act_now/emergency), matching that assessment. A detailed, reproducible proof-of-concept is published in the GitHub Security Advisory, so exploitability is demonstrated even though it is not weaponized at scale. Net: real and patchable priority on the vendor's recommended timeline, but low likelihood of mass exploitation given the obscure footprint, the required victim interaction, and HttpOnly cookies that prevent direct session theft.

An unauthenticated attacker sends a single HTTP GET to any public YesWiki page with a crafted Referer header such as 'http://"><img src=x onerror=...>x.com/poc', which is stored and later rendered unescaped in the referrers_sites handler. When any user - potentially an authenticated admin - views that wiki page's referrers_sites view, the injected JavaScript executes in their session's origin, letting the attacker perform same-origin authenticated actions and exfiltrate page content. A working PoC (curl command) is published in the GitHub Security Advisory, so the exploitation path is demonstrated; attack complexity is low but it requires a victim to visit the referrer-sites page (UI:P).