CVE-2026-116207
Deferred Deferred - Pending Action

Unauthenticated SQL Injection in YesWiki

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116207
EUVD
EUVD-2026-109465

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
YesWiki yeswiki 4.6.0
YesWiki yeswiki 5.0.0-alpha1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in YesWiki versions 4.6.0 to 4.6.9 and 5.0.0-alpha1 to 5.0.0-alpha3. It exists in the SearchManager::prepareSearchRequest() function where user-supplied field names from the Bazar entries search API are improperly sanitized using mysqli_real_escape_string. Attackers can inject backticks to execute arbitrary SQL subqueries, allowing them to read sensitive data like user password hashes or perform denial-of-service attacks using SLEEP() commands.

Detection Guidance

To detect this vulnerability, inspect YesWiki instances running versions 4.6.0 to 4.6.9 or 5.0.0-alpha1 to 5.0.0-alpha3. Check for unauthenticated requests to the Bazar entries search API endpoints. Look for unusual SQL queries or backtick characters in field names. Use network monitoring tools to identify suspicious GET requests targeting /?wiki=Bazar&... with query or searchfields parameters.

Impact Analysis

An attacker can exploit this to read sensitive data such as user password hashes, emails, or recovery keys. They may also perform denial-of-service attacks by exhausting database threads. In some cases, this can lead to full administrator account takeover due to password recovery flow abuse.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. It may result in data breaches, unauthorized disclosures, and non-compliance with security controls.

Mitigation Strategies

Immediately upgrade YesWiki to versions 4.7.0 or later, or 5.0.0-alpha4 or later. If upgrading is not possible, disable the Bazar entries search API or restrict access to trusted IPs. Apply input validation to sanitize query and searchfields parameters, ensuring no backticks or SQL keywords are allowed. Monitor database logs for unusual SLEEP() commands or excessive query execution times.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart