Is CVE-2026-116207 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116207 being exploited in the wild.

How severe is CVE-2026-116207?

Critical severity, with a CVSS score of 9.1, published 25 October 2026.

Which products and versions are affected?

YesWiki 4.6.0–4.6.7 and 4.6.0 before 4.7.0; 5.0.0-alpha1 before 5.0.0-alpha4.

Is there a fix for CVE-2026-116207?

Yes: fixed in YesWiki 4.7.0, 5.0.0-alpha4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116207 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116207?

Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116207: YesWiki SQL injection in Bazar search API via backtick in field names

CVE-2026-116207 · Severity: critical · CVSS 9.1 · Published 2026-10-25

YesWiki is a wiki platform with a built-in Bazar module that provides a public database search API. An unauthenticated attacker can inject arbitrary SQL into search requests by including backticks in field names, allowing them to read sensitive data like user credentials or cause denial of service by exhausting database connections.

Technologies: YesWiki. Vendors: YesWiki.

Quick answers

Is CVE-2026-116207 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116207 being exploited in the wild.
How severe is CVE-2026-116207?: Critical severity, with a CVSS score of 9.1, published 25 October 2026.
Which products and versions are affected?: YesWiki 4.6.0–4.6.7 and 4.6.0 before 4.7.0; 5.0.0-alpha1 before 5.0.0-alpha4.
Is there a fix for CVE-2026-116207?: Yes: fixed in YesWiki 4.7.0, 5.0.0-alpha4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116207 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116207?: Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: YesWiki 4.7.0, 5.0.0-alpha4

Technical details

The SearchManager::prepareSearchRequest() method uses mysqli_real_escape_string() to escape field names before embedding them in SQL backtick-quoted aliases, but this function does not escape backticks themselves, which are MySQL identifier-quoting characters. An attacker can break out of the alias context by injecting a backtick followed by arbitrary SQL expressions (scalar subqueries with SLEEP() or data extraction). The vulnerability is unauthenticated and reachable via public API endpoints; field-name validation is incomplete, allowing unknown fields and path traversal to reach SQL construction.

Affected products

YesWiki YesWiki 4.6.0–4.6.7 and 4.6.0 before 4.7.0; 5.0.0-alpha1 before 5.0.0-alpha4

Timeline

2026-10-09: disclosed
2026-10-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.