CVE-2026-116826— YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

Quick assessment

Affected

YesWiki yeswiki

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

YesWiki 4.7.0 之前的版本在 DuplicationManager::downloadFile() 函数中存在服务端请求伪造（SSRF）漏洞。该漏洞允许已认证的管理员通过 files 数组发起任意出站请求。攻击者可以向 /api/pages/{tag}/duplicate 接口 POST 包含 file:// 协议或内部 URL 的请求，从而将本地文件、云元数据或数据库凭据等敏感信息存储到公开可访问的 files/ 目录中。

CVSS 6.8 · Medium Updated Oct 27, 2026

Possible ATT&CK Techniques 3 AI

T1566 · Phishing T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile

Source: CVE Program / CVE List V5

Vulnerability Description

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
YesWiki	yeswiki	0 ~ 4.7.0	-

II. Public POCs for CVE-2026-116826

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116826

请登录查看更多情报信息。

Other References for CVE-2026-116826 (2)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qmpm-85pr-3qq8 vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-authenticated-ssrf-via-page-duplication-api-downloadfile third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116826

Same Patch Batch · YesWiki · 2026-10-26 · 9 CVEs total

CVE-2026-116827	6.8 MEDIUM	YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
CVE-2026-116821	6.5 MEDIUM	YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
CVE-2026-116825	6.5 MEDIUM	YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
CVE-2026-116823	6.1 MEDIUM	YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
CVE-2026-116824	6.1 MEDIUM	YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
CVE-2026-116822	5.3 MEDIUM	YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
CVE-2026-116820	5.3 MEDIUM	YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
CVE-2026-116828	4.9 MEDIUM	YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand

IV. Related Vulnerabilities

Same product: yeswiki

Same vendor: YesWiki

Same weakness: CWE-918