CVE-2026-52763
MediumCVSS 6.5Summary
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page.
Risk Assessment
Stored SQL injection allows arbitrary database read, potentially leading to exposure of sensitive information such as user data, passwords, or other confidential data.
Recommendation
Immediately upgrade YesWiki to version 4.6.6 or later, which includes a fix for this vulnerability.
Other vulnerabilities in YesWiki
See all- CVE-2026-52775High
YesWiki prior to version 4.6.6 contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.
- CVE-2026-52774Medium
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication.
- CVE-2026-52773Medium
YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in handlers/page/show.php without escaping. Because MySQL coerces malformed DATETIME strings, an attacker can append HTML or JavaScript to a valid archived revision timestamp, still load that archived revision, and execute arbitrary JavaScript in the victim's browser. The vulnerable form is only rendered when the victim can both read and edit the target page.
- CVE-2026-52772Medium
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders.
- CVE-2026-52771High
YesWiki from version 4.2.0 to before 4.6.6 has a SQL injection vulnerability in ApiController::deletePage(), where a page tag retrieved from the database is interpolated into a DELETE query without escaping. A low-privilege authenticated user can create a page with a tag that is a SQL fragment and execute arbitrary SQL in the wiki database.
- CVE-2026-52770High
YesWiki prior to version 4.6.6 has an unauthenticated SQL injection vulnerability in public Bazar entry-listing APIs, in numeric query filters. The filter value is escaped but inserted into SQL without quotes or numeric validation, allowing an attacker to inject boolean expressions and infer database contents.
- CVE-2026-52769High
YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in the POST /api/forms/{formId}/actor/inbox route, which is publicly exposed. HttpSignatureService::verifySignature() parses the HTTP Signature header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification. An unauthenticated attacker can make the server issue requests to internal services, including cloud metadata.
- CVE-2026-52767High
YesWiki from version 4.6.2 to before 4.6.6 has a vulnerability in HttpSignatureService::verifySignature(), which checks the result of openssl_verify() with a loose boolean negation. Since PHP treats -1 as truthy, the condition !(-1) is false, causing the error to be skipped and processing to continue even when signature verification failed.
- CVE-2026-52762High
YesWiki prior to version 4.6.6 contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template field, which are executed server-side when public semantic endpoints are requested.
- CVE-2026-52777Critical
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
Original NVD description (English source)
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install (default_write_acl='*'), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read. This issue has been patched in version 4.6.6.