YesWiki: SQL injection in Bazar nuagetag action
Summary
YesWiki before 4.6.7 contains an SQL injection in the Bazar nuagetag action, which inserts the unescaped tags attribute into a raw SQL IN clause. An attacker who can write pages can use a crafted tag with a trailing backslash to inject a UNION subquery and read data such as password hashes and other table contents. On default installations, where the default write ACL allows all users to edit pages, no authentication is required.
Affected
- YesWiki versions before 4.6.7 (Composer yeswiki/yeswiki, up to and including 4.6.6)
- Oldest affected version: Unknown.
Fixed in
- Fixed in YesWiki 4.6.7.
Workaround
- Restrict the default write ACL (avoid default_write_acl => '*') so that only trusted, authenticated users can edit pages.
- Disable the nuagetag action if it is not needed.
- Third-party guidance only; not confirmed by the vendor. WAF rules are not a substitute for the fix.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes.
- A public proof of concept is indicated but no public repository was found.
- No evidence of exploitation in the wild found; not listed in CISA KEV.
Our recommendation
- Identify all YesWiki instances and their versions.
- Upgrade to YesWiki 4.6.7 or later; the same release fixes sibling SQL injections CVE-2026-104457, CVE-2026-104456 and CVE-2026-104460.
- Until upgraded, restrict write access to trusted users and review the default write ACL.
- Review web logs and the user table for signs of abuse; reset passwords if an instance was open to anonymous edits.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-p9rm-p6pp-8m8c github.com
- VulnCheck advisory: YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter www.vulncheck.com
- YesWiki release v4.6.7 github.com
- OSV: CVE-2026-104462 osv.dev
- ionix threat center: CVE-2026-104462 www.ionix.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:47.
Original description (NVD)
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.