EUVD-2026-365789

fkie_cve-2026-52766

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.

GHSA-6x7x-gcmf-7r8x — YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

Affected: Packagist: yeswiki/yeswiki

### Summary

The `{{erasespamedcomments}}` wiki action (`actions/EraseSpamedCommentsAction.php`) accepts a `suppr[]` array from `POST` and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (`default_write_acl='*'`) on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users.

The action's `delete()` callee is `PageManager::deleteOrphaned()`, which despite its name does not check whether the target page is orphaned: it issues an unconditional `DELETE` against `pages`, `links`, `acls`, `triples`, `referrers`, and `tags` tables.

### Details

Three issues compose the vulnerability.

1. `actions/EraseSpamedCommentsAction.php` performs no authorization check before processing `$_POST['clean']` / `$_POST['suppr'][]` in `actions/EraseSpamedCommentsAction.php`:

```php public function run() { $wiki = &$this->wiki; ob_start(); // ... elseif (isset($_POST['clean'])) { $deletedPages = ''; if (!empty($_POST['suppr'])) { foreach ($_POST['suppr'] as $page) { echo 'Effacement de : ' . $page . "<br />\n"; if ($wiki->services->get(PageController::class)->…

Most recent entries from all

EUVD-2026-365789

fkie_cve-2026-52766

GHSA-6x7x-gcmf-7r8x — YesWiki vulnerable to unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action