CVE-2026-46670: YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManag

Executive brief

YesWiki is a popular open-source wiki and collaborative platform. A security flaw in its form-import feature allows an unauthenticated attacker to access the underlying database. This could lead to the theft of sensitive information, including user emails and hashed passwords, potentially compromising the entire site and its users.

Technical details

An unauthenticated SQL injection vulnerability exists in YesWiki's Bazar form-import component, specifically within the FormManager::create() function. The root cause is the unquoted concatenation of the 'bn_id_nature' parameter into an SQL INSERT statement. An attacker can exploit this by sending a specially crafted POST request to the Bazar form-import path, allowing them to inject arbitrary SQL. This can be used to perform blind SQL injection to exfiltrate sensitive data, such as user credentials and email addresses, from the database. The vulnerability is patched in version 4.6.4.

Affected products

• YesWiki YesWiki < 4.6.4

Timeline

• 2026-05-22: advisory: GitHub Advisory GHSA-jwvv-qr7q-cv8j published.
• 2026-05-22: patched: Fix released in version 4.6.4.

References

• https://api.github.com/users/SamyGhannad
• https://github.com/SamyGhannad
• https://api.github.com/users/SamyGhannad/gists%7B/gist_id%7D
• https://api.github.com/users/SamyGhannad/repos
• https://avatars.githubusercontent.com/u/8165968?v=4
• https://api.github.com/users/SamyGhannad/events%7B/privacy%7D