Description
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
Published: 2026-10-02
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Confidentiality Breach via SQL Injection
Action: Immediate Patch
AI Analysis

Impact

YesWiki versions prior to 4.6.7 are vulnerable to a classic SQL injection in the Bazar nuagetag action. The vulnerability arises because the tags attribute is concatenated directly into an IN clause without escaping. An attacker who can write page content can insert a tag ending with a backslash, break the string boundaries, and inject a UNION subquery that extracts password hashes and any other table data.

Affected Systems

This flaw affects any deployment of YesWiki before version 4.6.7. Default installations expose page-write rights to unauthenticated users, making the attack vector available to anyone who can access the site.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.8, indicating high severity. EPSS data is not available, but the existence of the flaw, combined with unrestricted write access on default setups, makes exploitation plausible. Because credential tables can be exfiltrated, the risk to confidentiality is substantial. The vulnerability is not currently listed in CISA KEV.

Generated by OpenCVE AI on October 2, 2026 at 13:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade YesWiki to version 4.6.7 or later, which contains the fix for the nuagetag SQL injection.
  • If an upgrade cannot be performed immediately, disable the nuagetag action or remove the tags parameter from the Bazar component to eliminate the code path that processes untrusted input.
  • Limit page-write permissions to trusted users or enforce authentication before allowing page edits, ensuring that only authorized staff can write page content.

Generated by OpenCVE AI on October 2, 2026 at 13:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Description YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
Title YesWiki before 4.6.7 SQL Injection via nuagetag tags parameter
First Time appeared Yeswiki
Yeswiki yeswiki
Weaknesses CWE-89
CPEs cpe:2.3:a:yeswiki:yeswiki:*:*:*:*:*:*:*:*
Vendors & Products Yeswiki
Yeswiki yeswiki
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Yeswiki Yeswiki
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-02T14:06:21.582Z

Reserved: 2026-10-02T00:55:11.982Z

Link: CVE-2026-104462

cve-icon Vulnrichment

Updated: 2026-10-02T14:05:23.138Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T12:17:18.467

Modified: 2026-10-02T15:17:08.050

Link: CVE-2026-104462

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T17:15:07Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')