CVE-2026-104460 – Unauthenticated Blind SQL Injection – YesWiki before 4.6.7

Summary

CVE-2026-104460 is an unauthenticated blind SQL injection vulnerability in YesWiki, an open-source wiki engine, affecting the {{newtextsearch}} search action. The flaw allows anonymous attackers to extract arbitrary data from the application database — including administrator password hashes — without any authentication or user interaction. The vulnerability carries a CVSS v4.0 base score of 8.7 (High).

Technical details

• Root cause: actions/newtextsearch.php concatenates Bazar list option (node) IDs directly into SQL REGEXP/LIKE clauses executed via DbService::loadAll() without escaping. The search phrase itself is escaped via $dbService->escape(), but the option ID is not sanitized at all.
• Trigger conditions: The attack requires a page using the {{newtextsearch}} action and an anonymously editable Bazar list in which a malicious option ID can be planted — conditions present in YesWiki’s default installation (the default RechercheTexte page and ListeType list).
• Attack vector: Network-based, unauthenticated, no user interaction required. An attacker plants a crafted option ID in an editable Bazar list, then issues repeated search requests to the vulnerable action, using differences in responses as a boolean oracle to infer database contents one bit at a time.
• Impact: Confidentiality-only impact (no integrity or availability impact) — blind data exfiltration from the database, including the yeswiki_users table containing administrator usernames, email addresses, and password hashes. The underlying database connection supports only single statements, which prevents stacked-query or file-write based code execution, but does not limit the data exfiltration impact. Publicly documented exploitation extracted an admin hash in roughly 431 anonymous requests; the resulting unsalted MD5 hash was crackable offline, leading to admin account takeover.

Affected software

• YesWiki, all versions prior to 4.6.7

Severity

• CVSS v4.0 Base Score: 8.7 (High) — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• CVSS v3.1 Base Score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate: Upgrade YesWiki to version 4.6.7 or later, which addresses the improper escaping of Bazar list option IDs in the search functionality.
• If immediate patching is not possible:
  • Restrict or disable anonymous editing of Bazar lists, particularly the default ListeType list, to prevent attackers from planting malicious option IDs.
  • Restrict or monitor access to pages using the {{newtextsearch}} action (e.g., the default RechercheTexte page).
  • Monitor web server logs for abnormally high volumes of search requests against the same page, which may indicate a boolean-based blind SQL injection attempt.
  • Rotate administrator credentials and enforce strong, salted password storage where configurable.

References

• CVE-2026-104460 at NVD
• GitHub Security Advisory GHSA-4333-x9p4-8xj7
• VulnCheck Advisory: YesWiki before 4.6.7 Unauthenticated Blind SQL Injection via newtextsearch