CVE-2026-52775: YesWiki Authenticated SQL Injection via ReactionManager
Summary
CVE-2026-52775: YesWiki has Authenticated SQL Injection via ReactionManager. Affects yeswiki/yeswiki versions < 4.6.6. Fixed in 4.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It is designed for ease of use and flexibility, enabling users to customize their wikis according to their needs. However, a recent vulnerability has been identified in its ReactionManager component, which could allow authenticated users to exploit SQL injection flaws.
Vulnerability Detail
The vulnerability arises from a SQL injection flaw in the ReactionManager::deleteUserReaction() method, where user input from the URL parameters {idreaction} and {id} is directly concatenated into a SQL LIKE clause without proper escaping or parameterization. This oversight allows any authenticated user to inject arbitrary SQL commands, potentially leading to unauthorized access to sensitive data, including password hashes and emails from the yeswiki_users table. The vulnerability is similar to CVE-2026-46670, which affects a different component of YesWiki but shares the same root cause of raw string concatenation in SQL queries.
How To Fix
Minimum fixed version
4.6.6
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the ReactionManager::deleteUserReaction() method to only trusted users until the patch can be applied. This can be done by modifying the ACL settings to limit access to specific user roles.
Conclusion
The CVE-2026-52775 vulnerability in YesWiki poses a significant risk due to its potential for SQL injection attacks by authenticated users. It is crucial to update to the latest version to mitigate this risk and ensure the security of user data.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
CVE-2026-52775 is a vulnerability in YesWiki that allows authenticated users to perform SQL injection attacks through the ReactionManager component.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The vulnerability can lead to full database read/write access, allowing attackers to extract sensitive information such as user passwords and emails.
To update YesWiki, run the command 'composer update yeswiki/yeswiki' in your terminal to install version 4.6.6 or later.
If you cannot update immediately, consider restricting access to the affected functionality and monitoring your application for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
