Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string, allowing attackers to supply a backtick to inject subqueries.
An unauthenticated attacker over the network can exploit the SQL injection vulnerability via the public Bazar entries API to read sensitive data such as user password hashes or exhaust database threads with SLEEP() commands, causing denial of service.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Upgrade YesWiki to version 4.7.0 or later for the 4.x branch, or to version 5.0.0-alpha4 or later for the 5.0.0 branch. As an interim mitigation, restrict access to the public Bazar entries API or disable it until patching is possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-116207 . See article
NVD published the first details for CVE-2026-116207
A CVSS base score of 9.1 has been assigned.
GitHub Advisories released a security advisory .
A critical SQL injection vulnerability scored at 9.1 on the CVSS 3.1 scale allows unauthenticated attackers to manipulate field names in a API, leading to exposure of sensitive data such as password hashes. While there are no public proof-of-concept exploits documented, a fix is available in version 4.7.0, and prior related vulnerabilities have been addressed in earlier software updates. The advisory reveals this flaw affects the Bazar API, indicating potential downstream risks for users relying on this technology. See article
YesWiki 9.1 — A Backtick, a String Escaper, and a Public API
CVE-2026-116207 - Exploits & Severity - Feedly
YesWiki 9.1 — A Backtick, a String Escaper, and a Public API
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
