YesWiki contains a SQL injection flaw in the ReactionManager::deleteUserReaction() function. The flaw arises because the {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This allows an attacker to inject arbitrary SQL, potentially enabling deletion of arbitrary data, extraction of sensitive information, or other database manipulation from within an authenticated session.

Any deployment of YesWiki older than version 4.6.6 is affected. The vulnerability exists in the YesWiki::yeswiki project and is present in all builds before 4.6.6, regardless of operating environment, as long as the default ReactionManager code is used.

The CVSS score of 8.8 indicates a high severity risk. Because authentication is required to use the vulnerable endpoint, the attack vector is limited to legitimate users or compromised accounts. No publicly disclosed exploit code is known and the EPSS score is not available, but the lack of credential compromise elevates the risk to any attacker who can gain user access. The vulnerability is not listed in CISA KEV, suggesting no confirmed industrial exploitation at this time. The potential impact includes unauthorized data deletion and schema tampering, which can lead to data loss or corruption if no proper safeguards are in place.