# CVE-2026-105224: YesWiki Bazar valeur action cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-105224-yeswiki-before-4-6-7-contains-a-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105224 · Severity: medium · CVSS 5.4 · Published 2026-10-04

YesWiki is a collaborative wiki platform that allows users to edit and create pages. The Bazar component's "valeur" action has a vulnerability that lets page editors fetch content from remote URLs and embed it into pages without filtering for malicious code. An attacker who can edit pages can trick the server into requesting internal or sensitive URLs and inject scripts that execute in other users' browsers.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-105224 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105224 being exploited in the wild.

**How severe is CVE-2026-105224?** Medium severity, with a CVSS score of 5.4, published 4 October 2026.

**Which products and versions are affected?** YesWiki before 4.6.7.

**Is there a fix for CVE-2026-105224?** Yes: fixed in 4.6.7. Until then: Restrict page editing permissions to trusted users only, and review existing page edits for malicious {{valeur}} action usage pointing to untrusted or internal URLs. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105224 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105224?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.6.7

Restrict page editing permissions to trusted users only, and review existing page edits for malicious {{valeur}} action usage pointing to untrusted or internal URLs.

## Technical details

The valeur action in tools/bazar/actions/valeur.php accepts a URL parameter from wiki markup, appends /html to it, fetches the content server-side via file_get_contents(), and echoes extracted HTML fragments without escaping. This enables both SSRF (Server-Side Request Forgery) to probe internal networks and XSS via unescaped remote content injection. A page editor can inject img onerror handlers or other JavaScript via attacker-controlled endpoints, and the absence of URL scheme/host allowlists, private-network blocking, or output sanitization allows full exploitation.

## Affected products

- YesWiki YesWiki before 4.6.7

## Timeline

- 2026-09-01: disclosed
- 2026-07-14: patched: Fix committed via GHSA-6rvf-7pwm-6j44

## References

- [https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23](https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23)
- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)