CVE-2026-104457: YesWiki before 4.6.7 SQL Injection via filtertags filterN parameter
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Default YesWiki installations before 4.6.7 are exposed. Exploitation can be performed by an unauthenticated attacker who can save filtertags markup in a page.
What does an attacker need to do to exploit it?
The attacker needs to supply a trailing-backslash token in a filterN attribute of Bazar filtertags markup. Under MySQL backslash escaping, this breaks quote parity and permits SQL injection through the tags.value IN (...) clause.
What could an attacker access?
The described technique allows injection of a five-column UNION subquery to read arbitrary database table data. This can include sensitive data such as password hashes.