YesWiki unauthenticated SQL injection in search
Unauthenticated SQL injection in YesWiki's search lets attackers run arbitrary SQL with no credentials. CVSS 9.1 critical, patched in 4.7.0 and 5.0.0-alpha4.
- Vendor
- YesWiki
- Product
- YesWiki
- CVSS
- 9.1
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-116207 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-116207 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-26 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-26. Full cross-catalog view: /kev-comparison
CVE-2026-116207 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-116207 is an unauthenticated SQL injection in YesWiki, a PHP-based open-source wiki platform. The flaw is in SearchManager::prepareSearchRequest(): field names from the HTTP query string are passed into SQL without sanitization, giving a remote attacker unauthenticated read (and potentially write) access to the database.
Affected versions: 4.6.0 up to but not including 4.7.0 (stable branch), and 5.0.0-alpha1 up to but not including 5.0.0-alpha4 (alpha branch). Fixed in 4.7.0 and 5.0.0-alpha4. No exploitation confirmed as of publication.
Update to 4.7.0 (stable) or 5.0.0-alpha4 (alpha). Advisory: GHSA-ccp2-6q93-hggh.
