CVE-2026-46670 in YesWiki
Summary
by MITRE • 08/11/2026
YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an `INSERT` statement and read the full database, including `yeswiki_users.password` hashes. Version 4.6.4 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability affects YesWiki versions prior to 464 where an unauthenticated SQL injection flaw exists in the Bazar form-import functionality. The vulnerability specifically resides within the FormManager::create() method which processes form data without adequate input sanitization, allowing malicious actors to inject arbitrary SQL commands into INSERT statements. The attack vector is accessible to any unauthenticated visitor of a default YesWiki installation, making it particularly dangerous as it requires no prior authentication credentials or privileged access.
The technical implementation of this vulnerability stems from insufficient parameter validation and sanitization within the form import path. When users submit forms through the Bazar component, the application fails to properly escape or parameterize user-supplied data before incorporating it into database queries. This creates a classic SQL injection scenario where an attacker can manipulate the query structure to extract sensitive information from the underlying database. The vulnerability is particularly severe because it allows for full database enumeration including credential hashes stored in the yeswiki_users.password field, providing attackers with potential access to user accounts and system compromise.
The operational impact of this vulnerability extends beyond simple data theft, as it enables comprehensive database reconnaissance and unauthorized access to user credentials. An attacker could leverage this vulnerability to gain complete control over the YesWiki installation, potentially escalating privileges or using stolen password hashes for further attacks within the network. The unauthenticated nature of the exploit means that attackers can exploit this weakness at any time without requiring valid login credentials, making it particularly attractive for automated scanning and exploitation campaigns.
Security mitigation for this vulnerability requires immediate upgrading to YesWiki version 464 or later, which includes proper input validation and parameterization fixes. Organizations should also implement network-level protections such as web application firewalls to detect and block suspicious SQL injection patterns targeting the affected endpoint. Additionally, regular security audits of PHP applications should include thorough review of database query construction practices and input handling mechanisms. This vulnerability aligns with CWE-89 which describes improper neutralization of special elements used in an SQL command and maps to ATT&CK technique T10715 for application layer protocol manipulation. Organizations should also consider implementing database activity monitoring to detect anomalous query patterns that may indicate exploitation attempts.