VYPR
Published Oct 27, 2026· 1 source

YesWiki: 17 Vulnerabilities Including Critical SQLi Disclosed Together

Key findings • A critical SQL injection vulnerability (CVE-2026-116207) in the Bazar search API allows unauthenticated attackers to execute arbitrary SQL queries. • High-severity SQL injectio…

Key findings

On October 27, 2026, a significant batch of 17 vulnerabilities was disclosed for YesWiki, impacting versions prior to 4.7.0. This coordinated disclosure event, spanning October 25th to 27th, revealed a range of security weaknesses including critical SQL injection, server-side request forgery (SSRF), cross-site scripting (XSS), and authorization bypass flaws. The most severe issues, CVE-2026-116207, a critical unauthenticated SQL injection vulnerability, and CVE-2026-116211, a high-severity SQL injection, highlight the potential for attackers to compromise sensitive data, including user password hashes. All disclosed vulnerabilities are addressed in YesWiki version 4.7.0.

Several vulnerabilities stem from improper handling of user-supplied input in various functions. CVE-2026-116828, a medium-severity SQL injection in despam.php, allows authenticated administrators to exfiltrate database information due to the from parameter being placed in an unquoted INTERVAL position. Similarly, CVE-2026-116211, a high-severity SQL injection in PageManager::save(), concatenates the date_maj_fiche field unescaped into an INSERT statement, enabling unauthenticated attackers to exfiltrate password hashes. Another critical SQL injection, CVE-2026-116207, affects the SearchManager::prepareSearchRequest() function, allowing unauthenticated attackers to inject SQL via the public Bazar entries search API.

Server-side request forgery (SSRF) is another prominent theme within this batch. CVE-2026-116827 and CVE-2026-116826, both medium-severity, allow authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV files or via the files array in the duplication API, respectively. Additionally, CVE-2026-116205, an unauthenticated SSRF vulnerability, permits remote attackers to fetch arbitrary URLs using wiki syntax in the render handler.

Cross-site scripting (XSS) vulnerabilities are also present, with several instances allowing for script injection. CVE-2026-116824, a medium-severity stored XSS in referrers_sites.php, can be exploited via crafted Referer headers. CVE-2026-116823, a reflected XSS, allows unauthenticated attackers to inject JavaScript through query parameters. CVE-2026-116206, a medium-severity stored XSS, enables authenticated users to inject scripts into comment bodies using raw-HTML syntax. Furthermore, CVE-2026-116203, a stored XSS in the filtertags action, allows anonymous attackers to inject markup that executes JavaScript. CVE-2026-116202, a stored XSS, permits low-privilege authenticated users to upload unsanitized SVG files.

The batch also includes vulnerabilities related to authorization and replay attacks. CVE-2026-116821, a medium-severity read-ACL bypass, allows self-registered attackers to access restricted pages and Bazar entries by using specially crafted usernames. CVE-2026-116825, a medium-severity flaw in HttpSignatureService::verifySignature(), lacks replay protection, enabling attackers to replay signed requests to the /api/forms/{formId}/actor/inbox endpoint. CVE-2026-116208, a high-severity missing authorization vulnerability, allows malicious ActivityPub servers to manipulate other actors' mirrored entries during sync operations. Finally, CVE-2026-116204, a medium-severity CSRF vulnerability in the despam action, allows unauthenticated attackers to delete or restore pages through an administrator's session. CVE-2026-116820, an information disclosure vulnerability, allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. CVE-2026-116822, a path traversal vulnerability, allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace.

All 17 vulnerabilities disclosed between October 25 and October 27, 2026, impacting YesWiki versions prior to 4.7.0, have been fixed in version 4.7.0. Users are strongly advised to update to the latest version to mitigate these risks. The coordinated disclosure highlights the importance of regular security audits and timely patching for web applications.

The breadth of vulnerabilities, including critical SQL injection and widespread XSS and SSRF flaws, underscores the need for vigilant security practices for YesWiki users. Promptly applying the available patch is crucial to prevent potential exploitation by malicious actors.

Key findings from this disclosure event include:

The batch of 17 vulnerabilities disclosed for YesWiki between October 25-27, 2026, includes critical SQL injection, multiple XSS, and SSRF flaws affecting versions prior to 4.7.0.

A stylized representation of the YesWiki logo, with code snippets and vulnerability symbols (like broken locks and warning signs) emanating from it, set against a dark, secure background.

Synthesized by Vypr AI