PT-2026-57030 · Yeswiki+2 · Yeswiki+1

CVE-2026-52770

·

Published

2026-07-09

·

Updated

2026-09-08

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6
Description YesWiki's public Bazar entry-listing APIs are subject to unauthenticated SQL injection. The issue occurs when the system processes numeric query filters; while the system escapes the filter value, it inserts it into the SQL statement without quotes or numeric validation. This allows an unauthenticated attacker to inject boolean SQL expressions and infer sensitive database contents, such as user account data, password hashes, and private wiki metadata, by observing whether entries are returned.
Technical details include:
  • API Endpoints: '/api/forms/{formId}/entries/{output}/{selectedEntries}', '/api/entries/{output}/{selectedEntries}', and '/api/entries/bazarlist'.
  • Vulnerable Parameters: query and queries.
  • Function Name: buildQueriesConditions() within the SearchManager class.
Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, restrict access to the affected API endpoints or avoid using numeric filters in the Bazar API until the update is applied.

Exploit

Fix

SQL injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-52770
GHSA-QG78-VMVC-FHJW

Affected Products

Yeswiki
Yeswiki/Yeswiki