# CVE-2026-116826: YesWiki server-side request forgery in DuplicationManager

Source: https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116826 · Severity: medium · CVSS 6.8 · Published 2026-10-27

YesWiki is a collaborative wiki platform that administrators use to manage content and pages. This vulnerability allows authenticated administrators to perform server-side request forgery attacks via the page duplication API, potentially exposing local files, cloud credentials, and database passwords stored in the publicly accessible files directory. An attacker with admin access can force the server to download files from arbitrary locations including local file paths and internal services.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-116826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116826 being exploited in the wild.

**How severe is CVE-2026-116826?** Medium severity, with a CVSS score of 6.8, published 27 October 2026.

**Which products and versions are affected?** YesWiki before 4.7.0.

**Is there a fix for CVE-2026-116826?** Yes: fixed in 4.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116826 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116826?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.7.0

## Technical details

The DuplicationManager::downloadFile() method in the page duplication API passes attacker-controlled URLs directly to curl_init() without SSRF protection, scheme validation, or protocol filtering. An authenticated administrator can POST crafted URLs to /api/pages/{tag}/duplicate with file:// or http:// protocols in the files array, and responses are written to the web-accessible files/ directory without extension restrictions. The vulnerability requires administrative authentication but results in read-back SSRF with arbitrary file write capabilities accessible to any unauthenticated visitor.

## Affected products

- YesWiki YesWiki before 4.7.0

## Timeline

- 2026-10-12: disclosed
- 2026-10-27: advisory

## References

- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qmpm-85pr-3qq8](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-qmpm-85pr-3qq8)
- [https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-authenticated-ssrf-via-page-duplication-api-downloadfile](https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-authenticated-ssrf-via-page-duplication-api-downloadfile)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)
- [YesWiki reflected cross-site scripting in Bazar field rendering](https://junglewise.ai/threats/cve-2026-116823-yeswiki-before-4-7-0-contains-a-reflected-cross-site-scripting)