# CVE-2026-116202: YesWiki stored XSS in ImageField SVG upload

Source: https://junglewise.ai/threats/cve-2026-116202-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116202 · Severity: medium · CVSS 5.4 · Published 2026-10-25

YesWiki is a collaborative wiki platform that allows users to create and manage content. An authenticated attacker can upload a malicious SVG image file that executes JavaScript code in the browsers of other users viewing that content, potentially leading to session hijacking, credential theft, or defacement. This vulnerability affects all versions before 4.7.0.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-116202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116202 being exploited in the wild.

**How severe is CVE-2026-116202?** Medium severity, with a CVSS score of 5.4, published 25 October 2026.

**Which products and versions are affected?** YesWiki before 4.7.0.

**Is there a fix for CVE-2026-116202?** Yes: fixed in 4.7.0. Until then: Restrict file upload permissions for authenticated users, or disable SVG uploads in the bazar ImageField configuration by removing 'svg' from the attach_config.ext_images list until upgrading to version 4.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116202 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116202?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0

Restrict file upload permissions for authenticated users, or disable SVG uploads in the bazar ImageField configuration by removing 'svg' from the attach_config.ext_images list until upgrading to version 4.7.0.

## Technical details

The ImageField class in YesWiki's bazar component fails to sanitize uploaded SVG files before storing them, even though a sibling FileField class was patched in v4.6.7. SVG files are included in the default image extensions list and are served with Content-Type: image/svg+xml, allowing embedded JavaScript to execute. An authenticated user can submit a malicious SVG via the entries API, which gets stored and executed for all subsequent viewers.

## Affected products

- YesWiki YesWiki before 4.7.0

## Timeline

- 2026-10-09: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-c5q6-7233-3v6g](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-c5q6-7233-3v6g)
- [https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-imagefield-svg-upload](https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-stored-xss-via-imagefield-svg-upload)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)