CVE-2026-46670: YesWiki SQL Injection Vulnerability

CVE-2026-46670 Overview

CVE-2026-46670 is an unauthenticated SQL injection vulnerability in YesWiki, a PHP-based wiki system. The flaw resides in the Bazar form-import path handled by FormManager::create(). Any unauthenticated visitor of a default YesWiki install can inject arbitrary SQL into an INSERT statement. Successful exploitation allows attackers to read the full database, including yeswiki_users.password hashes. YesWiki version 4.6.4 resolves the issue. The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can exfiltrate the entire YesWiki database, including administrative password hashes, enabling full site takeover.

Affected Products

YesWiki versions prior to 4.6.4
Default YesWiki installations exposing the Bazar form-import path
Any deployment using the FormManager::create() function without patch

Discovery Timeline

2026-08-11 - CVE-2026-46670 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-46670

Vulnerability Analysis

The vulnerability stems from insufficient input sanitization in the YesWiki Bazar module. The FormManager::create() function constructs an INSERT SQL statement using attacker-controlled data from the form-import path. Because the input is concatenated directly into the query, an attacker can break out of the INSERT context and append arbitrary SQL clauses.

Since YesWiki exposes this path without authentication on default installations, the attack surface includes any publicly reachable YesWiki instance below version 4.6.4. Successful exploitation yields read access to the entire database schema, including the yeswiki_users table, which stores password hashes.

Recovered password hashes enable offline cracking attempts against administrator credentials. Once cracked, attackers can log in as administrators, upload PHP files, and pivot to full remote code execution on the underlying host.

Root Cause

The root cause is missing parameterization in the SQL query built inside FormManager::create(). User-supplied form-import content is inserted into the query string without prepared statements or proper escaping. This maps directly to [CWE-89].

Attack Vector

An attacker sends a crafted HTTP request to the Bazar form-import endpoint of a vulnerable YesWiki instance. No authentication, user interaction, or elevated privileges are required. The malicious payload is embedded in fields that reach the vulnerable INSERT statement, allowing UNION-based or stacked-query extraction of database contents.

Refer to the GitHub Security Advisory GHSA-jwvv-qr7q-cv8j for the vendor's technical description.

Detection Methods for CVE-2026-46670

Indicators of Compromise

HTTP POST requests targeting the Bazar form-import endpoint containing SQL metacharacters such as single quotes, UNION SELECT, or comment sequences (--, #)
Unexpected read access patterns against the yeswiki_users table in database query logs
Web server access logs showing anonymous requests to form-import URLs followed by anomalous response sizes
New or unrecognized administrator accounts appearing after suspicious form-import activity

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect Bazar form-import request bodies for SQL injection signatures
Enable MySQL/MariaDB general query logging temporarily to identify malformed INSERT statements originating from YesWiki
Correlate web request logs with database error logs to surface injection attempts that trigger SQL syntax errors

Monitoring Recommendations

Monitor for outbound data volume spikes from the web server hosting YesWiki, which may indicate bulk database exfiltration
Alert on repeated failed authentication attempts following suspicious traffic to the Bazar module, suggesting offline hash cracking success
Track file integrity of YesWiki PHP files to detect post-exploitation webshell uploads

How to Mitigate CVE-2026-46670

Immediate Actions Required

Upgrade all YesWiki installations to version 4.6.4 or later without delay
Rotate all user passwords, especially administrator accounts, assuming hashes may have been exfiltrated
Review web server and database logs for signs of prior exploitation dating back to the deployment of the vulnerable code
Restrict access to the Bazar form-import endpoint via network controls until the patch is applied

Patch Information

The YesWiki maintainers released version 4.6.4 to remediate CVE-2026-46670. The fix introduces proper input handling in FormManager::create() to prevent SQL injection. Administrators should upgrade using the official release channels documented in the YesWiki GitHub Security Advisory.

Workarounds

Block unauthenticated access to the Bazar form-import path at the reverse proxy or web server level
Apply WAF rules that reject requests containing SQL injection payloads targeting YesWiki endpoints
Restrict the database user account used by YesWiki to the minimum required privileges to limit exfiltration impact

bash

# Example nginx configuration to restrict Bazar form-import access by IP
location ~* /\?.*action=(import|bazar) {
    allow 10.0.0.0/8;
    deny all;
}