CVE-2026-116207 Details
Description
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
A critical unauthenticated SQL injection vulnerability has been identified in YesWiki versions 4.6.0 prior to 4.7.0 and 5.0.0-alpha1 prior to 5.0.0-alpha4. The vulnerability resides in the SearchManager::prepareSearchRequest() function, where field names from the query and searchfields parameters of the public Bazar entries search API are inadequately validated. These field names are then inserted into a SQL SELECT statement as backtick-quoted aliases, with only partial escaping applied. This flaw allows attackers to inject subqueries that can be executed in the database context, potentially leading to unauthorized data access, such as user password hashes, or causing a denial-of-service by exhausting database threads with SLEEP() commands.
Users can upgrade to YesWiki version 4.7.0 or 5.0.0-alpha4, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | >= 4.6.0, < 4.7.0 (semver) >= 5.0.0-alpha1, < 5.0.0-alpha4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |