An unauthenticated SQL injection in YesWiki's public Bazar entries search API lets remote attackers read database contents, including user password hashes, or tie up database threads.
What Is It
CVE-2026-116207 is a SQL injection flaw (CWE-89) in SearchManager::prepareSearchRequest() in YesWiki. The public Bazar entries search API accepts query and searchfields parameters. It places the field names from those parameters inside a backtick-quoted alias, and the only escaping applied is mysqli_real_escape_string. That function does not neutralize backticks. An attacker can send a backtick to break out of the alias and inject subqueries.
NVD lists the CVSS v3.1 base score as 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. VulnCheck's secondary CVSS v4.0 score is 8.8 (HIGH).
Why It Matters
- No authentication needed: the vulnerable endpoint is a public search API, and the attack needs no privileges or user interaction.
- Data theft: injected subqueries can read database contents, including user password hashes.
- Denial of service: attackers can use
SLEEP()to exhaust database threads, which matches the High availability impact in the CVSS vector. - Easy to exploit: the CVSS vector rates it as network-reachable with low attack complexity.
This CVE has no CISA KEV entry, so CISA has not confirmed active exploitation. NVD published the record on 2026-10-25 and lists its status as "Deferred."
What's Vulnerable
| Product | Affected versions | Fixed version |
|---|---|---|
| YesWiki 4.x | 4.6.0 up to (not including) 4.7.0 | 4.7.0 |
| YesWiki 5.x pre-release | 5.0.0-alpha1 up to (not including) 5.0.0-alpha4 | 5.0.0-alpha4 |
Versions outside these ranges are listed as unaffected. NVD has not yet published any CPE matches.
Patch Status
Fixes are available:
- YesWiki 4.x: upgrade to 4.7.0 or later.
- YesWiki 5.0 alpha: upgrade to 5.0.0-alpha4 or later.
Because this CVE is not in KEV, there is no CISA required action or due date. Still, the flaw is critical, needs no authentication and sits on a public API, so internet-facing YesWiki instances should be upgraded quickly. Check the linked GitHub advisories for maintainer guidance.