---
id: "CVE-2026-116828"
kind: "vulnerability"
aliases: ["CVE-2026-116828"]
title: "YesWiki: SQL injection in despam.php lets admins read the database"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "yeswiki"]
not_affected_if: ["auth-required"]
published_at: "2026-10-27T00:17:18+00:00"
first_seen_at: "2026-10-27T00:25:56+00:00"
updated_at: "2026-10-27T00:26:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116828", "first_seen_at": "2026-10-27T00:25:56+00:00"}]
---

# YesWiki: SQL injection in despam.php lets admins read the database

YesWiki before 4.7.0 has an SQL injection in despam.php: the from POST parameter is escaped but placed in an unquoted INTERVAL position. An authenticated administrator can run blind SQL reads, including user password hashes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed YesWiki version; the sources say versions before `4.7.0` are affected
- unknown

## Fix

- Upgrade YesWiki to `4.7.0` or later
- unknown

## Timeline

- 2026-10-27T00:25:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116828

## From the sources

YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_