CVE-2026-104452

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description A cross-site request forgery (CSRF) issue exists in the filemanager page handler. The system deletes page attachments via GET requests without validating a CSRF token—a unique token used to verify that a request was intentionally sent by the user. An attacker can trick an authenticated page owner or administrator into performing a top-level GET navigation using the do parameter with values such as del, erase, or emptytrash, resulting in the deletion or permanent purging of page attachments.

Recommendations Update YesWiki to version 4.6.7 or later.