Read the docs
TI-2026-37882 Aliases CVE-2026-52766GHSA-6x7x-gcmf-7r8x

YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

Priority HIGH 78CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00579 47th percentileScored 2026-11-07
Fix Fixed yeswiki (YesWiki): 4.6.6yeswiki/yeswiki (Packagist): 4.6.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
YesWikiyeswikibefore 4.6.64.6.6Patch availableCNA
—yeswiki/yeswiki (Packagist)before 4.6.64.6.6Patch availableGHSA-6x7x-gcmf-7r8x
  • yeswiki VendorYesWiki Affected before 4.6.6 Fixed in 4.6.6 Patch available CNA
  • yeswiki/yeswiki (Packagist) Vendor— Affected before 4.6.6 Fixed in 4.6.6 Patch available GHSA-6x7x-gcmf-7r8x

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*——YesWiki
  • cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:* Versions — — ·YesWiki

Remediation

  • Fix · CNA yeswiki (YesWiki) Fixed in 4.6.6
  • Fix · GHSA-6x7x-gcmf-7r8x yeswiki/yeswiki (Packagist) Fixed in 4.6.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-52766
  2. 2026-10-03 Alias added: GHSA-6x7x-gcmf-7r8x

References

Other 4

  • TI-2026-37893 YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS) CVSS 3.1CRITICAL 9.8
  • TI-2026-34305 YesWiki: Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2025-29089 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download CVSS 3.1CRITICAL 10.0
  • TI-2024-34399 Use of a Broken or Risky Cryptographic Algorithm in YesWiki CVSS 3.1CRITICAL 9.9
  • TI-2026-80227 SQL injection in YesWiki Bazar entry creation via date_maj_fiche CVSS 4.0HIGH 8.8
  • TI-2026-66114 YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler CVSS 4.0HIGH 8.7
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences