Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

The last major version of YesWiki is currently being supported with security updates.

Version	Supported
doryphore 4.x	✅
cercopitheque 3.x	❌
bachibouzouk 2.x	❌
anacoluthe 1.x	❌

Reporting a Vulnerability

You can contact us by email at mailto:contact+security@yeswiki.net

Tags actions disclose names of ACL-restricted pages
GHSA-hx4v-hjvg-9p6w published Aug 31, 2026 by mrflos

Low
User enumeration via the lost-password flow
GHSA-892r-45m6-45xc published Aug 31, 2026 by mrflos

Moderate
Unauthenticated blind Server-Side Request Forgery in the public Bazar API via idtypeannonce
GHSA-gw65-cpc7-hww6 published Sep 1, 2026 by mrflos

Moderate
Unauthenticated Server-Side Request Forgery with partial read-back via the {{valeur}} action
GHSA-pghp-rrp4-q666 published Sep 1, 2026 by mrflos

Moderate
Unauthenticated Server-Side Request Forgery with response read-back via the {{syndication}} action
GHSA-jwh5-j4f4-c6xp published Sep 1, 2026 by mrflos

High
Arbitrary semantic-triple delete/create by any authenticated user via empty-filter scope bypass (admin-group lockout)
GHSA-9j7h-ccj2-jxv6 published Sep 1, 2026 by mrflos

High
Comments API editComment authorization keyed to attacker-supplied pagetag enables arbitrary page/comment overwrite
GHSA-894w-63wr-8x5r published Sep 1, 2026 by mrflos

High
ActivityPub inbox does not bind the verified signer to the activity actor, allowing cross-actor delete and update
GHSA-rm6r-grfg-4v78 published Sep 1, 2026 by mrflos

High
Unauthenticated open mail relay via contact mail AJAX handler
GHSA-36fx-49jj-57rw published Sep 1, 2026 by mrflos

Moderate
CSRF: arbitrary installed-package/extension deletion via GET in autoupdate UpdateAction
GHSA-jp5c-grgj-624x published Sep 1, 2026 by mrflos

High

Learn more about advisories related to YesWiki/yeswiki in the GitHub Advisory Database