YesWiki: Unauthenticated blind SQL injection in newtextsearch action
Summary
YesWiki before 4.6.7 contains a blind SQL injection flaw in the {{newtextsearch}} action, which searches Bazar lists. Bazar list option ids are concatenated into SQL queries without escaping. An anonymous attacker who can edit an anonymously editable Bazar list can plant a malicious option id and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes.
Affected
- YesWiki versions before 4.6.7 (Composer package yeswiki/yeswiki)
- Exploitation requires a Bazar list that allows anonymous editing and a page using {{newtextsearch}}
- The first affected version is unknown; sources differ.
Fixed in
- Upgrade to YesWiki 4.6.7 or later.
Workaround
- No vendor workaround known.
- Restrict editing of Bazar lists to authenticated users until the upgrade is done.
Exploitation
- CISA SSVC: exploitation status PoC, automatable yes, technical impact partial.
- A public proof-of-concept script is referenced in the advisory and records; no confirmed in-the-wild exploitation found.
- Not listed in CISA KEV. EPSS 0.00385.
Our recommendation
- Inventory all YesWiki instances and their versions, including Composer installations.
- Upgrade to YesWiki 4.6.7 or later.
- Review Bazar lists that allow anonymous editing and restrict them.
- Rotate admin passwords after patching, since hashes may have been exposed before the fix.
- Check web and database logs for unusual search requests on instances exposed before patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4333-x9p4-8xj7 github.com
- VulnCheck advisory: YesWiki before 4.6.7 Unauthenticated Blind SQL Injection www.vulncheck.com
- YesWiki release v4.6.7 github.com
- OSV: CVE-2026-104460 osv.dev
- Vulners CVE-2026-104460 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:00.
Original description (NVD)
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.