CVE-2026-116211: YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the datemajfiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT statement. Unauthenticated attackers on default installs can inject a sub-SELECT against wikiusers to exfiltrate password hashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.7.0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Default YesWiki installations in the affected 4.5.0 through before-4.7.0 range are exposed. An attacker does not need an account or user interaction to submit the malicious Bazar entry-creation request.
What access or conditions does an attacker need?
The attacker needs network access to the vulnerable YesWiki instance and the ability to send a Bazar entry-creation request containing a crafted date_maj_fiche value. No authentication, elevated privileges, or user interaction is required.
What information could be exposed?
The documented attack uses a sub-SELECT against the wiki_users table to exfiltrate password hashes. The vulnerability is an SQL injection in an INSERT operation because date_maj_fiche is concatenated into the query without escaping.
How can I determine whether my instance is affected?
Check whether the instance runs YesWiki 4.5.0 or a later 4.x release before 4.7.0. Also review Bazar entry-creation request handling and database or application logs for unexpected date_maj_fiche values or SQL query errors associated with PageManager::save().