CVE-2026-116211 Details
Description
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wiki_users to exfiltrate password hashes.
A SQL injection vulnerability has been identified in YesWiki versions 4.5.0 prior to 4.7.0, specifically within the PageManager::save() function. The issue arises because the date_maj_fiche field in Bazar entry-creation requests is concatenated into an INSERT statement without proper escaping. This flaw allows unauthenticated attackers on default installations to inject a sub-SELECT query targeting the wiki_users table, enabling the extraction of password hashes.
Users are advised to update YesWiki to version 4.7.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-wjf7-hrf3-9gcx | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/yeswiki-4.5.0-before-4.7.0-sql-injection-via-date-maj-fiche-in-bazar-entry-create | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | >= 4.5.0, < 4.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |