YesWiki: Batch of 8 Vulnerabilities Including Critical SQLi Disclosed Together
Eight vulnerabilities, including critical SQL injection flaws, were disclosed for YesWiki on October 25, 2026, affecting versions prior to 4.7.0.
Key findings
- Eight vulnerabilities disclosed for YesWiki on October 25, 2026, impacting versions before 4.7.0.
- Includes critical and high-severity SQL injection flaws (CVE-2026-116207, CVE-2026-116211).
- Multiple stored XSS, SSRF, and CSRF vulnerabilities also detailed.
- All disclosed issues are fixed in YesWiki version 4.7.0.
On October 25, 2026, a batch of eight vulnerabilities was disclosed for YesWiki, impacting versions prior to 4.7.0 and in some cases, pre-release alpha versions of 5.0.0. The disclosures include critical and high-severity flaws, with SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), and authorization bypass vulnerabilities. The most severe issues, CVE-2026-116207 (Critical, CVSS 9.1) and CVE-2026-116211 (High, CVSS 8.2), are unauthenticated SQL injection flaws.
The SQL injection vulnerabilities, CVE-2026-116211 and CVE-2026-116207, stem from improper handling of user-supplied data in page creation and search functionalities, respectively. CVE-2026-116211 allows attackers to exfiltrate password hashes by injecting sub-SELECT statements into the Bazar entry-creation request. CVE-2026-116207, found in the search API, enables attackers to inject SQL queries by manipulating field names.
Several stored cross-site scripting (XSS) vulnerabilities were also detailed. CVE-2026-116206 allows authenticated users to inject scripts into comment bodies via raw HTML syntax, which are then rendered unescaped. CVE-2026-116203 permits anonymous attackers to inject markup in action-attribute parameters, bypassing raw HTML gates and executing JavaScript on page views. Additionally, CVE-2026-116202 enables low-privilege authenticated users to upload unsanitized SVG files, leading to script execution when rendered.
Further impacting security, CVE-2026-116205 is an unauthenticated server-side request forgery (SSRF) vulnerability, allowing attackers to fetch arbitrary URLs by supplying wiki syntax to the render handler. This could be used to probe internal networks. CVE-2026-116208 presents a missing authorization vulnerability in the ActivityPubService, enabling malicious ActivityPub servers to manipulate mirrored entries of other actors during synchronization. Finally, CVE-2026-116204 is a cross-site request forgery (CSRF) vulnerability in the despam action, allowing unauthenticated attackers to delete or restore pages via an administrator's session.
All disclosed vulnerabilities were addressed in YesWiki version 4.7.0. Users are strongly advised to update to this version to mitigate the risks associated with these critical and high-severity flaws. The batch of disclosures highlights the importance of timely patching for YesWiki instances, particularly those exposed to the internet or handling user-generated content.
Key findings from this disclosure batch include:
- Two unauthenticated SQL injection vulnerabilities, one critical and one high severity.
- Multiple stored XSS flaws affecting comments, page rendering, and SVG uploads.
- An SSRF vulnerability allowing internal network probing.
- A CSRF flaw enabling unauthorized page deletion/restoration.
- An authorization bypass in ActivityPub sync functionality.
- All vulnerabilities patched in YesWiki 4.7.0.