All vulnerabilities
CVE-2026-104456GHSA-6rw5-62xf-q5xp

YesWiki before 4.6.7 Second-Order SQL Injection via ACL Username

YesWiki yeswiki
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 2 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.6.7Fixed versionCVE List
Published2 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 4.6.7yeswikiCVE List
  • 4.6.7yeswiki/yeswiki, composerGitHubcomposer require "yeswiki/yeswiki:^4.6.7"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.

Text from CVE List

Affected versions 3

  • yeswikiaffected: all versions before 4.6.7CVE List
  • yeswikiunaffected: 4.6.7CVE List
  • yeswiki/yeswiki, composer<= 4.6.6GitHub

References 2