CVE-2026-52770: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated

Executive brief

YesWiki, a collaborative wiki platform, contains a security flaw in its Bazar entry-listing component. An unauthenticated attacker can exploit this to extract sensitive information from the database, such as user account details and password hashes. This occurs because the system does not properly validate numeric search filters, allowing malicious database commands to be executed.

Technical details

An unauthenticated SQL injection vulnerability exists in YesWiki's Bazar API due to improper handling of numeric filters in `SearchManager::buildQueriesConditions()`. While the application uses `mysqli_real_escape_string` on input values, it fails to quote these values or perform numeric validation when they are part of a 'number' type field. This allows an attacker to append SQL syntax (e.g., using 'OR') to the numeric expression. By sending crafted GET requests to public routes like `/api/entries/bazarlist`, an attacker can perform boolean-based inference to extract sensitive data from the database. The vulnerability is patched in version 4.6.6.

Affected products

• yeswiki yeswiki < 4.6.6

Timeline

• 2026-06-02: disclosed: Initial disclosure on GitHub
• 2026-07-09: advisory: Advisory published and updated

References

• https://api.github.com/users/sondt99
• https://github.com/sondt99
• https://api.github.com/users/sondt99/gists%7B/gist_id%7D
• https://api.github.com/users/sondt99/repos
• https://avatars.githubusercontent.com/u/87920408?v=4
• https://api.github.com/users/sondt99/events%7B/privacy%7D