CVE-2026-116207 YesWiki 4.6.0 before 4.7.0 SQL Injection via Bazar Entries Search API

High 8.8 Published 25 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116207?

CVE-2026-116207 is a high-severity vulnerability in yeswiki, published on 25 Oct 2026.

Official description

YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. Attackers can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP().

Weakness: CWE-89

Which versions are affected by CVE-2026-116207?

How do I fix CVE-2026-116207?

No fix has been published for CVE-2026-116207 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116207 being exploited?

There is no known exploitation of CVE-2026-116207 in the wild and no public exploit code.

Sources

Also known as GHSA-7f6m-6c75-cf96.