YesWiki is an open-source collaborative platform used by educational institutions, businesses, and community organizations to create interactive wikis, manage content, and facilitate team collaboration. It offers customizable modules for documentation, communication, and data sharing, making it a versatile tool for various group projects and knowledge bases.
CVE-2026-46670 is a critical SQL injection vulnerability in YesWiki versions prior to 4.6.4. It arises from insufficient sanitization of user-supplied input in the Bazar form-import functionality, allowing attackers to inject arbitrary SQL commands into the database query.
The vulnerability is triggered via the form-import endpoint, where parameters such as 'import' are not properly filtered. An unauthenticated attacker can craft a malicious request to execute SQL statements, bypassing authentication and accessing sensitive data.
If exploited, an attacker can extract user credentials, email addresses, password hashes, and other confidential information. This could lead to unauthorized account access, data breaches, and potential compromise of the entire YesWiki instance, affecting all users and stored data.
- Upgrade YesWiki to version 4.6.4 or later to apply the security patch.
- Implement strict input validation and sanitization for all user-supplied data.
- Use prepared statements and parameterized queries for database interactions.
- Apply the principle of least privilege to database accounts used by the application.
- Enable detailed logging and monitoring to detect suspicious SQL injection attempts.
- Conduct regular security audits and penetration testing on the YesWiki instance.
- Deploy a web application firewall (WAF) to filter malicious requests.
- Review and restrict access to the form-import endpoint to authorized users only.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →