CVE-2026-52763

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6

Description A stored SQL injection exists in the recentchanges action via the actions/recentchanges.php endpoint. The system accepts a period argument from two different parameter sources. While the URL form is validated against a whitelist, the action-argument form is not validated, escaped, or parameterized. This value is passed to the getRecentlyChanged() function in includes/services/PageManager.php, where it is directly interpolated into a SQL WHERE clause. An attacker with permissions to edit a page can inject a UNION-based payload into the period variable. Once the page is saved, any visitor viewing the page will trigger the injection, allowing the attacker to perform an arbitrary read of the database. On default installations, this may be accessible to anonymous users.

Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, restrict page-edit permissions to trusted users to prevent the storage of malicious payloads.