YesWiki EUVD-2026-91477

Exploitation requires an authenticated account with permission to edit pages or post comments (PR:L), and the payload is delivered specifically through the markdown image syntax rendered by formatters/wakka.php, where a quote character in the image URL breaks out of the src attribute to inject an onerror event handler. Execution is gated on a victim - ideally an administrator - subsequently viewing the page containing the stored payload (UI:P/passive interaction). Limiting factors: instances restricted to trusted editors or with registration disabled greatly reduce exposure, and no code execution occurs until a victim renders the poisoned content. All YesWiki releases before 4.6.7 are affected; upgrading to 4.6.7 removes the condition.

This is a stored cross-site scripting flaw (CWE-79) with a vendor-supplied CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, scoring 5.1 (medium). The network attack vector and low complexity are offset by two meaningful brakes: PR:L means the attacker must already hold an account that can edit pages or post comments, and UI:P means a victim must view the poisoned page for the payload to fire. There is no EPSS score, KEV listing, or public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a medium-severity, authenticated-attacker issue rather than a drop-everything emergency. The real risk is contextual: because any comment-poster or page-editor can plant a payload that executes in an administrator's browser, the practical impact is privilege escalation within the wiki (admin session/CSRF-token theft, settings changes) on sites that allow open registration or untrusted contributors. On locked-down instances with only trusted editors, real-world risk is low. No signals conflict; the main limitation is the absence of exploitation-probability telemetry (EPSS) to gauge likelihood.

An attacker with a low-privileged account (or self-registered user on an open wiki) posts a comment or edits a page containing a markdown image whose src uses a quote to break out of the attribute and append an onerror handler. When an administrator later views that page, the injected JavaScript executes in the admin's authenticated session, enabling session/token theft or actions on their behalf. No public exploit code is identified at time of analysis, though the advisory describes the breakout technique precisely.