critical advisory October 25, 2026

YesWiki: Unauthenticated SQL injection in SearchManager (CVE-2026-116207)

An unauthenticated SQL injection vulnerability in YesWiki versions 4.6.0-4.6.x and 5.0.0-alpha1-alpha3 allows remote attackers to perform subquery injection to extract database content or cause denial-of-service.

Triage facts

Revision 1

Applicability: YesWiki (4.6.0 <= version < 4.7.0), YesWiki (5.0.0-alpha1 <= version < 5.0.0-alpha4) +2
Evidence: Unknown
Severity: Critical
Action: Immediate escalation
Sources: 3 public sources
Freshness: Revision 1Oct 25, 14:31 UTC
Detection: 2 rules
Vulnerabilities: 3 CVEs
Source quality: A1Likely

What's new

1. added detection rule: Detects CVE-2026-116211 Exploitation - SQL Injection in Bazar module Oct 25, 14:33 via nvd
2. added coverage for YesWiki (4.6.2 <= version < 4.7.0) Oct 25, 14:33 via nvd

YesWiki contains an unauthenticated SQL injection vulnerability in the SearchManager::prepareSearchRequest() method. The flaw stems from improper sanitization of field names within the Bazar entries search API. Specifically, the query and searchfields parameters are placed into backtick-quoted aliases using only mysqli_real_escape_string, which is insufficient for backtick encapsulation. This allows attackers to break out of the alias context and execute arbitrary SQL subqueries.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive database records, including user password hashes, or perform denial-of-service attacks by injecting time-based commands such as SLEEP().

Recommendation

Upgrade YesWiki to version 4.7.0 or 5.0.0-alpha4 or later to remediate the vulnerability.
Until patching is complete, restrict access to the public Bazar entries search API at the web application firewall or reverse proxy level.
Review web server access logs for anomalous requests to the Bazar search endpoint containing backtick characters (`) or SQL keywords commonly used for subquery injection (e.g., SELECT, UNION, SLEEP).

Immediate actions

Upgrade affected YesWiki instances to 4.7.0 or 5.0.0-alpha4.

IT Operations 48h

Upgrade YesWiki to version 4.7.0 or later.

IT Operations 72h

Upgrade YesWiki to 4.7.0

IT Operations 48h

Threat Hunt

Identify unauthenticated requests to Bazar search endpoints containing backticks or SQL keywords like SLEEP, UNION, or SELECT.

T1190 high high confidence hunt now

Data: Web server access logs

Identify unusual or unexpected synchronization events in ActivityPub logs originating from unknown or untrusted federated servers.

T1190 medium medium confidence hunt now

Data: YesWiki application logs, Federation activity audit logs

Hunt for anomalous SQL queries referencing wiki_users table in database logs

T1190 high high confidence hunt now

Data: Database audit logs, Web application logs

Mitigations

Implement WAF rules to block or sanitize backtick characters in search API parameters.

immediate IT Operations

CVE-2026-116207

Upgrade to YesWiki 4.7.0

immediate IT Operations

CVE-2026-116208

Detection coverage 2

Detects CVE-2026-116207 Exploitation - SQL injection in Bazar Search API

critical

Detects exploitation attempts against the Bazar entries search API where query parameters contain backtick characters used for alias injection.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detects CVE-2026-116211 Exploitation - SQL Injection in Bazar module

high

Detects potential SQL injection attempts against the YesWiki Bazar module by monitoring POST requests for SQL syntax in the date_maj_fiche parameter.