YesWiki EUVD-2026-91461

Exploitation requires that the target YesWiki instance (version before 4.6.7) have at least one page that renders the {{pointimage}} action, which provides the vulnerable POST handler; the attacker then supplies the victim page's pagetag to write to any page, including write-ACL-protected ones, with no authentication (PR:N). The flaw is a missing authorization check in tools/attach/actions/pointimage.php, so no special non-default configuration is needed beyond use of the pointimage feature. The key limiting factor is that impact is a stored XSS that only triggers when a user - most damagingly an administrator - subsequently views the poisoned page (reflected in AT:P), so there is no immediate server compromise and exploitation value depends on a privileged victim loading the content.

This is a credible but context-dependent priority rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated flaw, and the ACL-bypass primitive is the notable element: the missing authorization check in the pointimage action lets attackers write to pages that should be edit-restricted, so the attacker-facing step needs no privileges. The AT:P (attack requirement) and the stored-XSS nature mean impact is realized only when a victim - ideally an administrator - later renders the poisoned page, so delivery is unauthenticated but execution is passive and deferred. No EPSS score was provided, the CVE is NOT in CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals are therefore consistent (serious design flaw, but no exploitation telemetry) rather than conflicting. The vendor's own VI:H rating is aggressive for a reflected-content XSS and is better read as capturing admin-session/account-takeover potential via injected JavaScript. Net: patch promptly because exploitation is unauthenticated and the ACL bypass is powerful, but real-world urgency is tempered by YesWiki's limited deployment footprint and the requirement that a privileged user view the injected page.

An unauthenticated attacker identifies a YesWiki site (before 4.6.7) that has any page rendering the {{pointimage}} action, then sends a crafted POST with pagetag set to a write-protected target page plus malicious title/description fields containing HTML/JavaScript. Because pointimage.php saves the content without enforcing the page's write ACL, the payload is stored on the restricted page and executes in the browser of any viewer or administrator who later opens it, enabling session hijacking or admin actions. No public exploit code is identified at time of analysis, but the attack requires only standard HTTP requests.