YesWiki EUVD-2026-91463

Exploitation requires an active, authenticated session belonging to a page owner or administrator in YesWiki before 4.6.7, and that victim must perform user interaction - a top-level GET navigation to an attacker-supplied URL hitting the filemanager page handler with do=del, erase, or emptytrash. The vulnerable behavior is the handler deleting/purging page attachments on GET requests without validating a CSRF token, so no special non-default configuration is named. Limiting factors: the attacker cannot act without a logged-in privileged victim who is successfully social-engineered into the navigation, and impact is confined to deletion/permanent purge of page attachments (no confidentiality exposure or code execution).

This is a genuine but moderate-priority issue rather than a critical one, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L, base 5.3 Medium) correctly reflects a CSRF flaw: network-reachable and low-complexity, but gated by required user interaction (UI:P) and with no confidentiality impact and only limited integrity/availability impact (attachment deletion, not system compromise). No EPSS score was provided, the CVE is not on CISA KEV, and no public proof-of-concept is referenced, so this is best treated as no public exploit identified at time of analysis. The PR:N rating is accurate in CVSS terms - the attacker needs no account - but exploitation materially depends on tricking an already-authenticated page owner or administrator into following a crafted link, which bounds real-world impact to opportunistic or targeted social-engineering rather than mass automated exploitation. Bottom line: patch in the normal cycle; the destructive-but-recoverable-scope nature (loss of attachments, with 'emptytrash' making deletion permanent) raises the practical stakes somewhat above the modest numeric score.

An attacker crafts a malicious web page or email containing a link (or auto-navigating element) pointing at the target YesWiki instance's filemanager handler with do=del, erase, or emptytrash. When a logged-in page owner or administrator visits it, their browser issues the authenticated GET request and the server deletes or permanently purges the page's attachments without any CSRF token check. No public exploit code is referenced, but the attack is trivial to construct given the simple GET-based vector.