CVE-2026-52771: YesWiki SQL Injection Vulnerability

CVE-2026-52771 Overview

CVE-2026-52771 is a SQL injection vulnerability in YesWiki, an open-source wiki system written in PHP. The flaw exists in ApiController::deletePage(), which interpolates an attacker-controlled page tag into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. A low-privilege authenticated user can create a page whose tag contains a SQL fragment, mark it as non-orphaned using the {{include page="…"}} mechanism, then trigger the delete endpoint to execute arbitrary SQL. Versions from 4.2.0 up to 4.6.6 are affected. The issue is patched in version 4.6.6.

Critical Impact
Authenticated attackers can execute arbitrary SQL against the wiki database, enabling time-based blind data exfiltration from any table.

Affected Products

YesWiki versions 4.2.0 through 4.6.5
YesWiki ApiController component (deletePage() handler)
YesWiki handlers/page/deletepage.php handler

Discovery Timeline

2026-09-05 - CVE-2026-52771 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52771

Vulnerability Analysis

The vulnerability is a classic SQL Injection [CWE-89] rooted in unsafe string interpolation. YesWiki's POST /api/pages/{tag} endpoint accepts arbitrary URL-encoded values for the page tag, including single quotes, and persists them to the database. When an authorized user later deletes such a page, ApiController::deletePage() retrieves the stored tag and concatenates it directly into a DELETE statement targeting the _links table.

Because the page tag is attacker-controlled and never escaped before interpolation, injected SQL executes with the privileges of the wiki database user. Attackers can leverage time-based blind techniques to exfiltrate data from any table accessible to that user, including credentials and session data.

Root Cause

The root cause is missing input escaping in ApiController::deletePage(). The query DELETE FROM {$dbService->prefixTable('links')} WHERE to_tag = '$tag' treats persisted, user-supplied content as trusted SQL context.

Attack Vector

The attack requires authenticated access with page creation privileges. The attacker first creates a page whose tag contains SQL payload characters. The page must be non-orphaned, which the attacker achieves by referencing it through the standard {{include page="…"}} link mechanism. Invoking the delete endpoint then triggers execution of the injected SQL.

php

// Vulnerable code (before patch) and fix from ApiController.php
$result['notDeleted'] = [$tag];
if ($this->wiki->UserIsOwner($tag) || $this->wiki->UserIsAdmin()) {
    if (!$pageManager->isOrphaned($tag)) {
-        $dbService->query("DELETE FROM {$dbService->prefixTable('links')} WHERE to_tag = '$tag'");
+        $dbService->query("DELETE FROM {$dbService->prefixTable('links')} WHERE to_tag = '{$dbService->escape($tag)}'");
    }
    $done = $pageController->delete($tag);
    if (!$done || !empty($pageManager->getOne($tag, null, false))) {

Source: GitHub Commit 23d3cc1

Detection Methods for CVE-2026-52771

Indicators of Compromise

Page tags in the wiki database containing single quotes, SQL keywords (SELECT, SLEEP, UNION, BENCHMARK), or comment sequences (--, /*)
POST /api/pages/{tag} requests where the URL-encoded tag value contains SQL metacharacters
Unusually long response times on DELETE requests to /api/pages/{tag}, consistent with time-based blind injection
Database error log entries referencing malformed DELETE FROM ..._links WHERE to_tag = ... statements

Detection Strategies

Inspect web server access logs for requests to /api/pages/ containing URL-encoded quotes (%27) or SQL fragments
Query the wiki pages table for tag values that do not match the expected alphanumeric pattern used by YesWiki
Correlate page creation and page deletion events from the same low-privilege account within short time windows

Monitoring Recommendations

Enable MySQL/MariaDB general or slow query logs and alert on DELETE FROM statements against the _links table with anomalous WHERE clauses
Monitor authentication events for low-privilege accounts performing repeated page create-and-delete cycles
Deploy a Web Application Firewall (WAF) rule to flag SQL metacharacters submitted to /api/pages/{tag} endpoints

How to Mitigate CVE-2026-52771

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later without delay
Audit the wiki pages and links tables for tag values containing SQL metacharacters and remove suspicious entries
Rotate database credentials and any secrets that may have been readable from the wiki database
Review account activity for low-privilege users who created and deleted pages during the exposure window

Patch Information

The fix is included in YesWiki Release v4.6.6. The patch wraps the interpolated $tag with $dbService->escape($tag) inside ApiController::deletePage() and imports DbService in handlers/page/deletepage.php. Full technical context is documented in GitHub Security Advisory GHSA-8f2v-2qhj-gfwg.

Workarounds

Restrict page creation and deletion permissions to trusted administrators until the patch is applied
Place YesWiki behind a WAF rule that blocks single quotes and SQL keywords in the tag path segment of /api/pages/{tag}
Enforce strict input validation at the reverse proxy layer to allow only [A-Za-z0-9] characters in wiki page tags

bash

# Example: upgrade YesWiki via git to the patched release
cd /var/www/yeswiki
git fetch --tags
git checkout v4.6.6
php composer.phar install --no-dev --optimize-autoloader