Description

YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the field parameter of the mail handler. Attackers can craft links whose field value breaks out of the ajax-mail-form action attribute to execute JavaScript in victims' browsers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-10-02T12:17:19.050Z",
  "pubdate": "2026-10-02T12:17:19.050Z",
  "executiveSummary": "YesWiki versions prior to 4.6.7 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability.\nThis security flaw allows unauthenticated remote attackers to inject malicious client-side scripts into the application via the 'field' parameter within the mail handler.\nThe vulnerability occurs because the application fails to adequately sanitize or encode user-supplied input before rendering it in the HTML context of the 'ajax-mail-form' action attribute.\nBy crafting a malicious URL, an attacker can trick a legitimate user into interacting with a link that executes arbitrary JavaScript within the context of the user's session.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information such as cookies or tokens.\nThis vulnerability is critical for organizations relying on YesWiki for collaborative content management, as it facilitates unauthorized interactions without requiring any prior authentication from the attacker.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw located in the mail handler component of YesWiki. The root cause is the improper handling of the 'field' parameter, which is processed by the mail functionality to define attributes within an HTML form element.\nSpecifically, the application takes the input provided via the 'field' parameter and echoes it directly into the 'action' attribute of the 'ajax-mail-form'. Because the application fails to implement strict output encoding or validation on this input, an attacker can inject special characters, such as double quotes, which allow them to break out of the intended HTML attribute context.\nThe attack flow begins when an attacker crafts a malicious URL containing a payload designed to close the 'action' attribute and inject a new JavaScript event handler, such as 'onmouseover' or 'onerror', or by closing the tag entirely to insert a script block. For example, by supplying a value like '\" onmouseover=\"alert(1)\"', the attacker forces the browser to interpret the injected code when the victim interacts with the manipulated form elements.\nSince this is a reflected XSS attack, the payload is not stored persistently on the server but is instead delivered via a link shared with a victim. When the victim clicks the link, the server reflects the malicious payload back to the victim's browser as part of the HTTP response. The browser, trusting the source, executes the injected JavaScript within the victim's session.\nThis vulnerability is particularly dangerous because it does not require authentication or elevated privileges. Any unauthenticated user who can send a link to a target user can initiate the attack. The network exposure is broad, as the mail handler is typically accessible over the public web. Once the JavaScript executes, the attacker gains the ability to perform actions that the victim is authorized to perform, potentially leading to unauthorized data modification, account takeover, or the delivery of malicious content to other users.\nThe vulnerability persists across all YesWiki versions prior to 4.6.7, where the mail handler's input processing logic remains unpatched."
}