CVE-2026-104462 Overview
CVE-2026-104462 is a SQL injection vulnerability in YesWiki versions prior to 4.6.7. The flaw resides in the Bazar nuagetag action, which concatenates the unescaped tags attribute directly into a raw SQL IN clause. Attackers with page-write access can craft a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery. On default YesWiki installations, page-write access is available to unauthenticated users, exposing the application to anonymous exploitation. Successful attacks allow exfiltration of password hashes and arbitrary table data from the backend database.
Critical Impact
Unauthenticated attackers can inject arbitrary SQL on default YesWiki installs and exfiltrate user password hashes.
Affected Products
- YesWiki versions prior to 4.6.7
- Bazar extension nuagetag action
- Default YesWiki deployments permitting unauthenticated page writes
Discovery Timeline
- 2026-10-02 - CVE-2026-104462 published to NVD
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-104462
Vulnerability Analysis
The vulnerability is a classic SQL injection [CWE-89] in the Bazar nuagetag action handler. The handler accepts a tags attribute and incorporates it into a raw SQL IN (...) clause without parameterization or escaping. YesWiki wraps each tag in single quotes before concatenation, which normally prevents injection through standard payloads.
An attacker breaks this scheme by submitting a tag value ending with a backslash character. The trailing backslash escapes the closing single quote generated by YesWiki, extending the string literal across the delimiter. The parser then treats subsequent attacker-controlled content as SQL syntax rather than data. This allows the attacker to append a UNION SELECT subquery that pulls data from arbitrary tables, including the YesWiki user table containing password hashes.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command. The nuagetag action builds the IN clause through string concatenation rather than using prepared statements or parameter binding. The code also fails to escape backslash characters before wrapping tag values in quotes, enabling quote-parity bypass.
Attack Vector
Exploitation occurs over the network through standard HTTP requests to a YesWiki page containing the nuagetag action. On default installs, no authentication is required because page-write access is open. An attacker submits a page or action parameter where the tags attribute terminates in a backslash followed by injected SQL syntax. The crafted UNION subquery returns attacker-selected columns from arbitrary tables, allowing bulk extraction of credentials and sensitive records. See the GitHub Security Advisory and the VulnCheck SQL Injection Advisory for technical details.
Detection Methods for CVE-2026-104462
Indicators of Compromise
- HTTP requests to YesWiki pages containing nuagetag action parameters with tags values ending in a backslash (\) character.
- Request bodies or query strings containing UNION, SELECT, or information_schema keywords in proximity to the tags attribute.
- Unexpected database read activity against the YesWiki user table or tables storing password hashes.
- New or anomalous page edits by unauthenticated or low-reputation sources that insert nuagetag markup.
Detection Strategies
- Inspect web server access logs for POST or GET requests targeting Bazar nuagetag endpoints with suspicious tag parameter structures.
- Deploy web application firewall rules that flag tags parameters containing backslash-quote sequences or SQL keywords.
- Enable MySQL or MariaDB general query logging temporarily to identify malformed IN clauses originating from the YesWiki process.
Monitoring Recommendations
- Alert on bursts of page-edit requests from a single IP targeting pages that render nuagetag output.
- Monitor outbound HTTP responses from YesWiki for payloads containing hashed credential patterns such as bcrypt or MD5 prefixes.
- Correlate authentication failures and successful logins following suspicious nuagetag request activity to identify credential replay.
How to Mitigate CVE-2026-104462
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later, which contains the patch for the nuagetag SQL injection.
- Restrict page-write permissions so unauthenticated users cannot modify pages or submit nuagetag actions.
- Rotate all YesWiki user credentials and invalidate active sessions if exploitation is suspected.
- Review database audit logs for unauthorized UNION SELECT queries referencing user or configuration tables.
Patch Information
The YesWiki maintainers released version 4.6.7 to address the vulnerability. The fix sanitizes the tags attribute before SQL construction in the Bazar nuagetag action. Refer to the GitHub Security Advisory GHSA-p9rm-p6pp-8m8c for commit references and upgrade instructions.
Workarounds
- Disable or remove the Bazar nuagetag action from templates until the upgrade can be applied.
- Require authentication for all page-write operations by tightening the YesWiki access control configuration.
- Deploy a WAF signature that blocks requests containing a backslash immediately preceding SQL keywords in tags parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
