Information Disclosure in YesWiki by The YesWiki Team

CVE-2026-116820

What is CVE-2026-116820?

Versions of YesWiki prior to 4.7.0 are vulnerable to an information disclosure issue where unauthenticated users can manipulate public Bazar listing API requests by appending the 'showreq' parameter. This vulnerability allows attackers to extract sensitive information, including SQL query structures, table names, JSON storage paths, access control logic, and collation details. The exposure of this data significantly heightens the risk of SQL injection attacks, enabling targeted exploitation of the application.

References