CVE-2026-116207— YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

Quick assessment

Affected

YesWiki yeswiki

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

YesWiki 4.6.0 至 4.7.0 之前的版本，以及 5.0.0-alpha1 至 5.0.0-alpha4 之前的版本，在 SearchManager::prepareSearchRequest() 函数中存在一个无需认证的 SQL 注入漏洞。该漏洞源于公开 Bazar 条目搜索 API 的 query 和 searchfields 参数中的字段名被放入反引号（backtick）包裹的别名中，且仅通过 mysqli_real_escape_string 进行转义。攻击者可利用此缺陷注入反引号以执行子查询，

CVSS 9.1 · Critical Updated Oct 25, 2026

Possible ATT&CK Techniques 3 AI

T1069.002 · Domain Groups T1499.003 · Application Exhaustion Flood T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

Source: CVE Program / CVE List V5

Vulnerability Description

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
YesWiki	yeswiki	4.6.0 ~ 4.7.0	-
YesWiki	yeswiki	5.0.0-alpha1 ~ 5.0.0-alpha4	-

II. Public POCs for CVE-2026-116207

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116207

请登录查看更多情报信息。

Other References for CVE-2026-116207 (3)

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh vendor-advisory
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877 vendor-advisory
https://www.vulncheck.com/advisories/yeswiki-4.6.0-before-4.7.0-sql-injection-via-bazar-entries-search-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116207

Same Patch Batch · YesWiki · 2026-10-25 · 8 CVEs total

CVE-2026-116211	8.2 HIGH	YesWiki 4.5.0 before 4.7.0 SQL Injection via date_maj_fiche in Bazar entry create
CVE-2026-116208	8.1 HIGH	YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts
CVE-2026-116204	8.1 HIGH	YesWiki before 4.7.0 CSRF via despam Admin Action
CVE-2026-116206	6.4 MEDIUM	YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
CVE-2026-116203	6.1 MEDIUM	YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
CVE-2026-116202	5.4 MEDIUM	YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
CVE-2026-116205	5.3 MEDIUM	YesWiki before 4.7.0 Unauthenticated SSRF via [[\|URL]] Raw-Inclusion Syntax

IV. Related Vulnerabilities

Same product: yeswiki

Same vendor: YesWiki

Same weakness: CWE-89