YesWiki, a PHP-based wiki platform used by community organisations, non-profits and research groups, carries an unauthenticated SQL injection flaw in its public search function. Tracked as CVE-2026-116207 and rated CVSS 9.1, critical, the flaw affects YesWiki 4.6.0 through 4.6.x and 5.0.0-alpha1 through 5.0.0-alpha3. No credentials and no user interaction are required, which makes any internet-facing installation running an affected version an immediate patching priority.

The weakness sits in SearchManager::prepareSearchRequest(). Field names from the query and searchfields parameters of the public Bazar entries search API are placed in a backtick-quoted alias escaped only with mysqli_real_escape_string. An attacker can supply a backtick to inject subqueries, reading data such as user password hashes or exhausting database threads with SLEEP() calls. The flaw is classified as CWE-89, improper neutralisation of special elements used in an SQL command.

Fixed versions and interim protection

The fix is in YesWiki 4.7.0 on the stable branch and 5.0.0-alpha4 on the alpha branch. Site owners should upgrade to 4.7.0 or later, or to 5.0.0-alpha4 or later if they are on the alpha track, and then confirm the upgrade completed. If an upgrade cannot be done immediately, disabling or restricting access to the search endpoint limits exposure until a maintenance window is available. That step reduces risk; it does not replace the update.

What to check after patching

No exploitation of this flaw had been confirmed in the reports checked for this brief, but the public CVE record and reporting agree that exploitation is technically straightforward. Administrators should review database and web logs for unusual search requests, check for unexpected database load, and rotate any credentials that could have been exposed if a vulnerable version was ever reachable from the internet.