CVE-2026-52771— YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Quick assessment
Affected
YesWiki yeswiki
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
YesWiki 是一个用 PHP 编写的 Wiki 系统。在 4.2.0 版本至 4.6.6 版本之前， 方法将从数据库中检索到的页面标签直接拼接进 查询语句中，且未进行转义处理。由于页面标签由攻击者控制—— 接口接受任意 URL 编码的值（包括单引号），并将其存储起来，因此一个低权限的已认证用户可以创建一个标签为 SQL 片段的页面，通过标准的 链接机制使该页面成为非孤立页面，然后调用删除端点，从而在 Wiki 数据库中执行任意 SQL 语句——甚至可以从任意表中通过基于时间的盲注方式提取数据。该问题已在 4.6
Possible ATT&CK Techniques 2 AI
T1120 · Peripheral Device Discovery T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-52771
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)
Source: CVE Program / CVE List V5
Vulnerability Description
YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page="…"}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-52771
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-52771
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-52771 (1)
Vendor Advisories for CVE-2026-52771 (1)
Other References for CVE-2026-52771 (1)
-
🔗 Release v4.6.6 · YesWiki/yeswiki · GitHub x_refsource_MISC
Same Patch Batch · YesWiki · 2026-09-04 · 12 CVEs total
| CVE-2026-52777 | 9.4 CRITICAL | YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize |
| CVE-2026-52766 | 9.1 CRITICAL | YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action |
| CVE-2026-52775 | 8.8 HIGH | YesWiki Authenticated SQL Injection in ReactionManager |
| CVE-2026-52769 | 8.3 HIGH | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId` |
| CVE-2026-52767 | 8.2 HIGH | YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(.. |
| CVE-2026-52770 | 7.5 HIGH | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ye |
| CVE-2026-52762 | 7.1 HIGH | YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via |
| CVE-2026-52763 | 6.5 MEDIUM | YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitra |
| CVE-2026-52773 | 6.1 MEDIUM | Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` |
| CVE-2026-52774 | 6.1 MEDIUM | Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki |
| CVE-2026-52772 | 5.5 MEDIUM | YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.h |
IV. Related Vulnerabilities
Same product: yeswiki
-
CVE-2026-52777
YesWiki: Authenticated PHP Object Injection in BazarImportAc -
CVE-2026-52775
YesWiki Authenticated SQL Injection in ReactionManager -
CVE-2026-52774
Reflected XSS via Unescaped `id` Parameter in Bazar Widget H -
CVE-2026-52773
Reflected XSS via Unescaped Archived-Revision `time` Paramet -
CVE-2026-52772
YesWiki: Bazar form-field templates still apply `|raw('html'
Same vendor: YesWiki
-
CVE-2026-52777
YesWiki: Authenticated PHP Object Injection in BazarImportAc -
CVE-2026-52775
YesWiki Authenticated SQL Injection in ReactionManager -
CVE-2026-52774
Reflected XSS via Unescaped `id` Parameter in Bazar Widget H -
CVE-2026-52773
Reflected XSS via Unescaped Archived-Revision `time` Paramet -
CVE-2026-52772
YesWiki: Bazar form-field templates still apply `|raw('html'
Same weakness: CWE-89
-
CVE-2026-52775
YesWiki Authenticated SQL Injection in ReactionManager -
CVE-2026-52770
Improper Neutralization of Special Elements used in an SQL C -
CVE-2026-52763
YesWiki: SQL injection via the `recentchanges` action `perio -
CVE-2026-85643
code-projects Online Shopping System adduser.php mysqli_quer -
CVE-2026-53756
Emlog Blind SQL Injection via Authentication Cookie
V. Comments for CVE-2026-52771
No comments yet