CVE-2026-52775 Details
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6.
A SQL injection vulnerability has been identified in YesWiki, a PHP-based wiki system, prior to version 4.6.6. The issue resides in the ReactionManager component, specifically within the deleteUserReaction() function. This vulnerability allows authenticated users to inject arbitrary SQL by manipulating the {idreaction} and {id} URL path parameters. The exploitation occurs because these parameters are directly concatenated into a SQL LIKE clause without proper escaping or parameterization. As a result, any self-registered user could potentially read or write to the database, including extracting password hashes and emails from the yeswiki_users table.
Users are advised to upgrade to YesWiki version 4.6.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4pf7-cc4r-g63h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/YesWiki/yeswiki/commit/90ca54fb518e1c43a1ead6e4f5bf9f0389789841 | [email protected] | Source CodeVendor |
| https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 | [email protected] | Release NotesVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4pf7-cc4r-g63h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.x |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |