CVE-2026-52771

Name of the Vulnerable Software and Affected Versions YesWiki versions 4.2.0 through 4.6.5

Description YesWiki contains a second-order SQL injection issue where data is safely stored in the database but later used in a query without proper escaping. A low-privilege authenticated user can create a page with a tag containing a SQL fragment via the POST /api/pages/{tag} endpoint. By making this page non-orphaned using the {{include page="…"}} link mechanism, the attacker can then trigger the vulnerability by calling the DELETE /api/pages/{tag} endpoint. This occurs because the ApiController::deletePage() function retrieves the raw tag from the database and interpolates it directly into a DELETE FROM … links WHERE to tag = '$tag' query.

This flaw allows an attacker to execute arbitrary SQL commands within the wiki database, enabling time-based blind data exfiltration from any table, including the retrieval of user password hashes and private page bodies. Additionally, an attacker could potentially wipe the entire links table or cause a denial of service by exhausting the database worker pool using time-delay functions.

Recommendations Update YesWiki to version 4.6.6. As a temporary workaround, restrict access to the DELETE /api/pages/{tag} endpoint for low-privilege users.