YesWiki Search Has Critical Unauthed SQL Injection

CVE-2026-116207. CVSS 9.1, critical. Unpatched YesWiki installations are exposed right now.

YesWiki is a PHP-based wiki platform used by French nonprofits, community organizations, and research groups. Versions 4.6.0 through 4.6.x and 5.0.0-alpha1 through 5.0.0-alpha3 carry an unauthenticated SQL injection in SearchManager::prepareSearchRequest(). Field names from the HTTP query string pass into SQL without sanitization. No credentials, no user interaction, no prior access required.

The GitHub security advisory (GHSA-ccp2-6q93-hggh) has the full technical detail. The fix landed in 4.7.0 (stable) and 5.0.0-alpha4.

Exploitation status

No exploitation confirmed as of this report. Unconfirmed: treat accordingly. The advisory was filed by the YesWiki development team through GitHub’s private security disclosure process.

What to do

Update to 4.7.0 or later (stable branch), or 5.0.0-alpha4 or later (alpha). Any installation running 4.6.x or 5.0.0-alpha1/2/3 has an injectable search endpoint with no authentication barrier.

If upgrading is not immediately possible, disabling or restricting access to the search endpoint limits exposure until a maintenance window opens.

Context

This is the second critical PHP web application CVE in two days. PHP itself issued emergency patches for two critical RCEs last week. Separately, PHP2Shell operators are actively exploiting PHP targets in government infrastructure as of today’s reporting. The pattern: PHP web applications with unpatched input-handling flaws remain a consistent attack surface.

For an earlier example of a critical web application CVE with confirmed exploitation, see the Collabora CODE Server coverage from earlier this month.