Is CVE-2026-104450 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-104450?

CVE-2026-104450 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-104450

Description

YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.