CVE-2026-52775

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6

Description An issue exists in the ReactionManager::deleteUserReaction() function where authenticated users can perform a SQL injection. This occurs because the {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without proper escaping or parameterization. This flaw allows an authenticated user to execute arbitrary SQL commands, potentially leading to full database read and write access, including the extraction of user password hashes and emails.

Recommendations Update to version 4.6.6. As a temporary mitigation, restrict access to the /api/reactions/{idreaction}/{id}/{page}/{username} endpoint for non-administrative users.