CVE-2026-116207: YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqlirealescapestring. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
YesWiki versions 4.6.0 before 4.7.0 are affected, as are 5.0.0-alpha1 before 5.0.0-alpha4. The affected functionality is the public Bazar entries search API.
Does exploitation require an account or user interaction?
No. The vulnerability is unauthenticated and remotely exploitable, with no user interaction required.
What can an attacker do through this issue?
An attacker can inject subqueries through crafted field names in the query or searchfields parameters. This can expose data such as user password hashes or consume database threads using SLEEP(), causing availability impact.
What input should be checked when investigating possible exploitation?
Review requests to the public Bazar entries search API for query or searchfields parameter values containing backticks or unusual field-name syntax. These parameters are the identified injection path.