Unauthenticated SQL Injection in YesWiki SearchManager
CVE-2026-116207

8.8HIGH

Key Information:

Vendor

Yeswiki

Status
Yeswiki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116207?

YesWiki versions prior to 4.7.0 and 5.0.0-alpha4 are susceptible to an unauthenticated SQL injection vulnerability. This issue arises in the SearchManager component, where field names sourced from the query and searchfields parameters within the public Bazar entries search API are inadequately secured. Attackers can exploit this flaw by injecting their own subqueries through crafted requests, allowing unauthorized access to sensitive data, such as user password hashes, and potentially overwhelming database resources. To mitigate this risk, users are advised to upgrade to fixed versions promptly.

Affected Version(s)

yeswiki 4.6.0 < 4.7.0

yeswiki 5.0.0-alpha1 < 5.0.0-alpha4

yeswiki 4.7.0

References

https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://github.com/YesWiki/yeswiki/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-4.6.0-before...
third-party-advisory

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-pi
manus-use
bp0lr
.