# CVE-2026-116207: YesWiki SQL injection in Bazar search API via backtick in field names

Source: https://junglewise.ai/threats/cve-2026-116207-yeswiki-4-6-0-before-4-7-0-and-5-0-0-alpha1-before-5-0-0-alpha4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-25. Updated: 2026-10-25  
License: CC BY 4.0 with a link back

CVE-2026-116207 · Severity: critical · CVSS 9.1 · Published 2026-10-25

YesWiki is a wiki platform with a built-in Bazar module that provides a public database search API. An unauthenticated attacker can inject arbitrary SQL into search requests by including backticks in field names, allowing them to read sensitive data like user credentials or cause denial of service by exhausting database connections.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-116207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116207 being exploited in the wild.

**How severe is CVE-2026-116207?** Critical severity, with a CVSS score of 9.1, published 25 October 2026.

**Which products and versions are affected?** YesWiki 4.6.0–4.6.7 and 4.6.0 before 4.7.0; 5.0.0-alpha1 before 5.0.0-alpha4.

**Is there a fix for CVE-2026-116207?** Yes: fixed in YesWiki 4.7.0, 5.0.0-alpha4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116207 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116207?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in YesWiki 4.7.0, 5.0.0-alpha4

## Technical details

The SearchManager::prepareSearchRequest() method uses mysqli_real_escape_string() to escape field names before embedding them in SQL backtick-quoted aliases, but this function does not escape backticks themselves, which are MySQL identifier-quoting characters. An attacker can break out of the alias context by injecting a backtick followed by arbitrary SQL expressions (scalar subqueries with SLEEP() or data extraction). The vulnerability is unauthenticated and reachable via public API endpoints; field-name validation is incomplete, allowing unknown fields and path traversal to reach SQL construction.

## Affected products

- YesWiki YesWiki 4.6.0–4.6.7 and 4.6.0 before 4.7.0; 5.0.0-alpha1 before 5.0.0-alpha4

## Timeline

- 2026-10-09: disclosed
- 2026-10-25: advisory

## References

- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-ccp2-6q93-hggh)
- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-hgxv-w4r8-8877)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)