Threats tagged 'ghsa-56wp-34hq-q74f'

YesWiki versions prior to 4.7.0 have a path traversal vulnerability in the BazarListeAction component. This flaw allows unauthenticated attackers to manipulate the template GET parameter to select arbitrary templates within the @bazar Twig namespace. Exploitation can lead to page defacement by forcing unintended layouts on pages using the bazarliste action when visitors follow a crafted link.