CVE-2026-116207GHSA-ccp2-6q93-hgghGHSA-hgxv-w4r8-8877

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

YesWiki yeswiki

Open in Threatline Record JSON

CVSS

8.8High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet

Fixed in4.7.0Also 5.0.0-alpha4CVE List

Published25 Oct 2026Updated 25 Oct 2026CVE List

What fixes it

4.7.0yeswikiCVE List
5.0.0-alpha4yeswikiCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@thehackerwire.bsky.social: 🔴 CVE-2026-116207 - Critical (9.1) YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL i... https://www.thehackerwire.com/vulnerability/Bluesky: CVE posts, 25 Oct 2026

Description

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

Text from CVE List

Affected versions 4

yeswikiaffected: 4.6.0 before 4.7.0CVE List
yeswikiunaffected: 4.7.0CVE List
yeswikiaffected: 5.0.0-alpha1 before 5.0.0-alpha4CVE List
yeswikiunaffected: 5.0.0-alpha4CVE List