CVE-2026-104457 Overview
CVE-2026-104457 is a SQL injection vulnerability in YesWiki versions before 4.6.7. The flaw resides in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) SQL clause. Unauthenticated attackers on default installations can save filtertags markup inside a wiki page using a trailing-backslash token. The token breaks quote parity under MySQL backslash escaping, enabling injection of a five-column UNION subquery. Successful exploitation lets attackers read arbitrary database tables, including stored password hashes.
Critical Impact
Unauthenticated attackers can extract password hashes and other sensitive database content from affected YesWiki instances through a saved wiki page.
Affected Products
- YesWiki versions prior to 4.6.7
- Default YesWiki installations allowing unauthenticated page edits
- Deployments using MySQL as the backing database
Discovery Timeline
- 2026-10-02 - CVE-2026-104457 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104457
Vulnerability Analysis
The vulnerability is a classic SQL injection flaw [CWE-89] in the Bazar component of YesWiki. The filtertags action builds a SQL IN (...) clause from user-controlled filterN tokens stored in page markup. Instead of using parameterized queries, the code wraps each token in single quotes and concatenates it directly into the query string. Because the tokens are not escaped, an attacker who ends a token with a backslash shifts the quote boundary interpreted by MySQL. The next token therefore starts inside raw SQL context, allowing arbitrary clause injection.
Root Cause
The root cause is improper neutralization of special characters when constructing the dynamic SQL IN list. The code assumes that wrapping values in single quotes alone is sufficient protection. Under MySQL's default backslash-escaping behavior, a trailing \ within a token escapes the closing quote. This desynchronizes the quoting state and lets attacker-supplied data become executable SQL. The design decision to persist filtertags markup from unauthenticated page saves amplifies the impact.
Attack Vector
An unauthenticated attacker edits or creates a wiki page on a default YesWiki install and embeds filtertags markup containing a filterN attribute whose value ends with a backslash. When the page renders, YesWiki expands the markup and executes the malformed query. The injected UNION SELECT of five columns returns rows from attacker-chosen tables, such as the user credential store. Results are reflected into the rendered tag list on the page. The vulnerability is network-reachable and requires no privileges or user interaction. See the GitHub Security Advisory GHSA-p87r-f4x4-8r4g and the VulnCheck Advisory for SQL Injection for the proof-of-concept details.
Detection Methods for CVE-2026-104457
Indicators of Compromise
- Wiki pages containing filtertags or bazarliste markup with filterN attribute values ending in a backslash character.
- Database query logs showing tags.value IN (...) statements containing UNION SELECT clauses with five columns.
- Unexpected HTTP POST or PUT requests to YesWiki page-save endpoints from unauthenticated sources.
- Rendered pages that display content resembling password hashes, email addresses, or other table rows inside tag listings.
Detection Strategies
- Review YesWiki page revisions created or modified after deployment for filtertags markup containing \ tokens.
- Enable MySQL general query logging and alert on queries referencing tags.value IN combined with UNION.
- Inspect web server access logs for anomalous page-edit POST bodies containing URL-encoded backslashes alongside filter parameters.
- Correlate page-save events with subsequent GET requests that render the modified page from unusual source addresses.
Monitoring Recommendations
- Baseline normal filtertags usage in your YesWiki content and flag deviations in automated monitoring.
- Centralize PHP application logs and MySQL query logs for correlation and retention.
- Monitor outbound traffic from the YesWiki host for signs of post-exploitation credential reuse.
- Alert on authentication attempts using accounts whose hashes could have been exposed through the Bazar table.
How to Mitigate CVE-2026-104457
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later as the primary remediation.
- Audit all wiki pages for malicious filtertags markup and remove tampered revisions.
- Rotate credentials for all YesWiki accounts, assuming password hashes may have been exfiltrated.
- Restrict unauthenticated page creation and editing where it is not required.
Patch Information
The vulnerability is fixed in YesWiki 4.6.7. The upstream patch properly sanitizes filterN tokens before including them in the tags.value IN (...) clause. Refer to the GitHub Security Advisory GHSA-p87r-f4x4-8r4g for release notes and commit references.
Workarounds
- Require authentication for page edits by changing the default ACLs in YesWiki configuration.
- Place a web application firewall rule in front of YesWiki that blocks POST bodies containing filtertags with backslash-terminated filter values.
- Temporarily disable the Bazar filtertags action in site configuration until the upgrade can be deployed.
- Restrict database user privileges so the YesWiki account cannot read sensitive tables beyond its functional scope.
# Configuration example: enforce authenticated edits in wakka.config.php
$config['default_write_acl'] = '+'; # only registered users can write
$config['default_read_acl'] = '*'; # public read remains allowed
$config['default_comment_acl'] = '+'; # only registered users can comment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
