CVE-2026-52775: YesWiki SQL Injection Vulnerability

CVE-2026-52775 Overview

YesWiki, a PHP-based wiki system, contains a SQL injection vulnerability in the ReactionManager::deleteUserReaction() method [CWE-89]. Any authenticated user can inject arbitrary SQL through the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. The vulnerability affects all versions prior to 4.6.6, including the latest development branch. The maintainers patched the issue in version 4.6.6.

Critical Impact
An authenticated attacker can extract, modify, or delete database contents by injecting SQL through reaction deletion URL parameters, compromising wiki data confidentiality, integrity, and availability.

Affected Products

YesWiki versions prior to 4.6.6
YesWiki latest development branch (pre-patch)
Deployments using the bazar reaction functionality

Discovery Timeline

2026-09-05 - CVE-2026-52775 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52775

Vulnerability Analysis

The flaw resides in includes/services/ReactionManager.php, specifically the deleteUserReaction() method. This method constructs a raw SQL LIKE clause by concatenating the $user, $reactionId, and $id variables directly into the query string passed to tripleStore->delete(). Because these values originate from URL path parameters and reach the query without sanitization, an authenticated user can break out of the string literal and append arbitrary SQL. The vulnerable code path executes with the database privileges granted to the YesWiki application account. Exploitation yields unauthorized read and write access to the underlying tables, which typically store user credentials, page contents, and configuration triples.

Root Cause

The root cause is missing input escaping when building a dynamic SQL fragment. The original implementation trusted the $reactionId and $id values supplied via the request. The patch introduces $this->dbService->escape() around each concatenated variable, applying the driver-level escaping routine before the fragment reaches the database.

Attack Vector

An authenticated user issues an HTTP request to the reaction deletion endpoint with a crafted {idreaction} or {id} path parameter. The parameter contains SQL metacharacters that terminate the string literal and inject additional clauses. No administrative privileges are required. The attack succeeds over the network against any reachable YesWiki instance below version 4.6.6.

php

// Patch diff from includes/services/ReactionManager.php
// fix(bazar): GHSA-4pf7-cc4r-g63h
                     "(`value` NOT LIKE '%\"date\":\"%')"
             );
         } else {
-            return $this->tripleStore->delete($pageTag, self::TYPE_URI, null, '', '', 'value LIKE \'%user":"' . $user . '","idReaction":"' . $reactionId . '","id":"' . $id . '"%\'');
+            return $this->tripleStore->delete($pageTag, self::TYPE_URI, null, '', '', 'value LIKE \'%user":"' . $this->dbService->escape($user) . '","idReaction":"' . $this->dbService->escape($reactionId) . '","id":"' . $this->dbService->escape($id) . '"%\'');
         }
     }
 }

Source: YesWiki security commit 90ca54f

Detection Methods for CVE-2026-52775

Indicators of Compromise

HTTP requests to reaction deletion URLs containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in the {idreaction} or {id} path segments.
Web server access logs showing unusually long or URL-encoded path parameters routed to the ReactionManager handler.
Database error entries referencing malformed LIKE clauses or unexpected column references originating from wiki reaction operations.

Detection Strategies

Inspect application logs for authenticated sessions issuing reaction deletion requests with non-numeric or non-standard identifier formats.
Deploy a web application firewall rule that inspects YesWiki reaction endpoints for SQL injection payloads.
Correlate authenticated user activity with subsequent anomalous database query patterns.

Monitoring Recommendations

Monitor the YesWiki application version and confirm all instances report 4.6.6 or later.
Alert on database triple-store operations that return unexpectedly large result sets following reaction deletion calls.
Track new or modified user accounts and privilege changes that could indicate post-exploitation persistence.

How to Mitigate CVE-2026-52775

Immediate Actions Required

Upgrade all YesWiki deployments to version 4.6.6 immediately, prioritizing internet-facing instances.
Audit authenticated user accounts and revoke access for stale or unknown accounts to reduce the attacker pool.
Review database logs for evidence of prior injection attempts against reaction endpoints.

Patch Information

The fix is included in YesWiki 4.6.6. The corrective change wraps user-supplied identifiers with $this->dbService->escape() before concatenation into the SQL LIKE clause. Technical details are published in the GitHub Security Advisory GHSA-4pf7-cc4r-g63h.

Workarounds

If patching cannot occur immediately, restrict access to the wiki so only trusted authenticated users can reach reaction endpoints.
Place YesWiki behind a web application firewall with SQL injection signatures enabled for the reaction URL pattern.
Enforce least-privilege on the database account used by YesWiki to limit the blast radius of a successful injection.

bash

# Upgrade YesWiki to the patched release
cd /var/www/yeswiki
git fetch --tags
git checkout v4.6.6
# Verify the running version
grep -R "'version'" includes/constants.php