{"id":"CVE-2026-116207","kind":"vulnerability","aliases":["CVE-2026-116207"],"related":[],"title":"YesWiki: unauthenticated SQL injection in Bazar search reads password hashes","description":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().","summary":"YesWiki's public Bazar entries search API places field names from the query and searchfields parameters into a backtick-quoted SQL alias that is escaped only with mysqli_real_escape_string. An unauthenticated attacker can inject subqueries to read data such as user password hashes or exhaust database threads with SLEEP().","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","package","php","self-hosted","yeswiki"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; versions 4.6.0 up to but not including `4.7.0`, and 5.0.0-alpha1 up to but not including `5.0.0-alpha4`, are affected\n- Confirm whether the public Bazar entries search API is reachable from the internet on the instance","fix":"- Upgrade YesWiki 4.x to `4.7.0` or later\n- Upgrade YesWiki 5.0 alpha builds to `5.0.0-alpha4` or later\n- Rotate user passwords and session secrets if the instance was reachable before patching, since password hashes may have been read","status":"open","published_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","triaged_at":"2026-10-25T14:42:09+00:00","updated_at":"2026-10-25T14:42:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T14:42:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade YesWiki 4.x to `4.7.0` or later\n- Upgrade YesWiki 5.0 alpha builds to `5.0.0-alpha4` or later\n- Rotate user passwords and session secrets if the instance was reachable before patching, since password hashes may have been read","reach":"internet","title":"YesWiki: unauthenticated SQL injection in Bazar search reads password hashes","impact":"high","summary":"YesWiki's public Bazar entries search API places field names from the query and searchfields parameters into a backtick-quoted SQL alias that is escaped only with mysqli_real_escape_string. An unauthenticated attacker can inject subqueries to read data such as user password hashes or exhaust database threads with SLEEP().","category":"package","nicknames":[],"who_cares":["yeswiki","php","self-hosted","mysql"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads user password hashes and other database contents from the server.","analyst_note":"Sources list only NVD; confirm whether the Bazar search API is enabled by default and check the upstream YesWiki advisory for exploitation status and any workaround.","how_to_check":"- Check the installed YesWiki version in the wiki's package or version file; versions 4.6.0 up to but not including `4.7.0`, and 5.0.0-alpha1 up to but not including `5.0.0-alpha4`, are affected\n- Confirm whether the public Bazar entries search API is reachable from the internet on the instance","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Any public YesWiki instance running a version in the affected range, because the flaw is reachable through the unauthenticated Bazar search API with no login needed. Instances on versions outside the stated ranges, or whose Bazar search API is not publicly reachable, are less exposed; the sources do not describe a non-default setting that removes the exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":3424,"output_tokens":704,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116207':13A,16A '-2026':12A,15A '4.6.0':77C '4.7.0':79C '5.0.0':81C,84C 'alia':46B,117C 'alpha1':82C 'alpha4':85C 'api':30B,109C 'attack':58B,125C 'backtick':43B,115C,129C 'backtick-quot':42B,114C 'bazar':6A,27B,106C 'contain':86C 'cve':11A,14A 'data':64B,134C 'databas':72B,142C 'entri':28B,107C 'escap':49B,54B,118C,123C 'exhaust':71B,141C 'field':32B,95C 'hash':10A,69B,139C 'host':22B 'inject':4A,60B,90C,131C 'mysql':17B 'mysqli':52B,121C 'name':33B,96C 'packag':18B 'paramet':39B,102C 'password':9A,68B,138C 'php':19B 'place':31B,111C 'preparesearchrequest':94C 'public':26B,105C 'queri':36B,99C 'quot':44B,116C 'read':8A,63B,133C 'real':53B,122C 'search':7A,29B,108C 'searchfield':38B,101C 'searchmanag':93C 'self':21B 'self-host':20B 'sleep':75B,145C 'sql':3A,45B,89C 'string':55B,124C 'subqueri':61B,132C 'suppli':127C 'thread':73B,143C 'unauthent':2A,57B,88C 'user':67B,137C 'vulner':91C 'yeswiki':1A,23B,24B,76C","nicknames":[],"mitigations":[],"who_affected":"Any public YesWiki instance running a version in the affected range, because the flaw is reachable through the unauthenticated Bazar search API with no login needed. Instances on versions outside the stated ranges, or whose Bazar search API is not publicly reachable, are less exposed; the sources do not describe a non-default setting that removes the exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116207","severity":null,"published_at":"2026-10-25T14:17:01+00:00","modified_at":"2026-10-25T14:17:01+00:00","first_seen_at":"2026-10-25T14:41:23+00:00","fetched_at":"2026-10-25T14:41:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}