---
id: CVE-2026-116206
title: YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
summary: >-
  YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting
  vulnerability that allows authenticated users to inject script into comment
  bodies using the wakka raw-HTML syntax. Attackers can post comments via the
  /api/comments …
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki >= 4.2.0 < 4.7.0
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T13:20:36.803Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116206'
references:
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wq96-vjjh-hfc6'
    label: GitHub Security Advisory (GHSA-wq96-vjjh-hfc6)
  - url: >-
      https://www.vulncheck.com/advisories/yeswiki-4.2.0-before-4.7.0-stored-xss-via-comment-raw-html-syntax
    label: >-
      VulnCheck Advisory: YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment
      Raw-HTML Syntax
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.938Z'
---

## Overview

YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can post comments via the /api/comments endpoint that render unescaped through the Twig raw filter, executing JavaScript in administrators' and visitors' sessions.

## Affected

- `yeswiki >= 4.2.0 < 4.7.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.