CVE-2026-104456

Summary

A second-order SQL injection vulnerability in YesWiki allows attackers to bypass read access controls by registering a specially crafted username containing double-quote characters, which then gets used unescaped in database queries. This enables attackers to read sensitive database contents and circumvent ACL restrictions.

Exploitability

Exploitation requires a self-registration capability and involves crafting a username with double-quote payload that gets stored and later used in an unescaped LIKE clause, making it moderately difficult but achievable for attackers with registration access.

Blast radius

If exploited, this vulnerability could allow attackers to read sensitive database information and bypass read ACLs across the entire YesWiki instance, potentially exposing private content and user data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to YesWiki 4.6.7 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.