CVE-2026-104457GHSA-p87r-f4x4-8r4g
YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
YesWiki yeswiki
CVSS
8.8HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.6.7yeswikiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
Text from CVE List
Affected versions 2
- yeswikiaffected: all versions before 4.6.7CVE List
- yeswikiunaffected: 4.6.7CVE List