CVE-2026-116820: YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
YesWiki versions from 4.6.0 up to, but not including, 4.7.0 are affected. Exposure requires public Bazar listing API requests to be reachable by an unauthenticated attacker.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker can add the showreq parameter to a public Bazar listing API request.
What information can be disclosed?
The response can reveal assembled SQL queries, including database table names, JSON storage paths, ACL filter logic, and collation details. This information can help an attacker prepare more targeted SQL injection attempts.
How can I determine whether my instance is affected?
Confirm whether the instance runs a YesWiki version from 4.6.0 before 4.7.0 and exposes public Bazar listing API requests. Affected requests may return assembled SQL-query information when showreq is appended.