What is the CVSS score of CVE-2026-41143?

CVE-2026-41143 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of YesWiki are affected by CVE-2026-41143?

CVE-2026-41143 is a high-severity SQL injection vulnerability in YesWiki's bazar module that allows authenticated users to execute arbitrary database queries, potentially exposing credentials and…. A patch is available.

How to fix or mitigate CVE-2026-41143?

Within 24 hours: Inventory all YesWiki installations and confirm versions currently deployed; determine if any instances expose the /api/entries/{formId} endpoint to untrusted authenticated users. Within 7 days: Upgrade YesWiki to version 4.6.1 or later; test the upgrade in a staging environment before production deployment. Within 30 days: Conduct a database audit to identify any unauthorized access logs or anomalous queries during the window of exposure; review access controls to restrict bazar module API endpoints to trusted users only.

YesWiki CVE-2026-41143

EUVD-2026-28312 HIGH

SQL Injection (CWE-89)

2026-05-07 GitHub_M

GHSA-f58v-p6j9-24c2

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 07, 2026 - 07:01 EUVD

Source Code Evidence Fetched

May 07, 2026 - 05:47 vuln.today

Analysis Generated

May 07, 2026 - 05:47 vuln.today

CVE Published

May 07, 2026 - 05:08 nvd

HIGH 8.8

DescriptionGitHub Advisory

YesWiki is a wiki system written in PHP. Prior to version 4.6.1, YesWiki bazar module contains a SQL injection vulnerability in tools/bazar/services/EntryManager.php at line 704. The $data['id_fiche'] value (sourced from $_POST['id_fiche']) is concatenated directly into a raw SQL query without any sanitization or parameterization. This issue has been patched in version 4.6.1.

AnalysisAI

Authenticated SQL injection in YesWiki bazar module allows low-privileged users to execute arbitrary SQL queries against the MySQL backend. The vulnerability exists in EntryManager.php line 704 where POST parameter 'id_fiche' is concatenated directly into a SELECT query without sanitization. Any authenticated user can exploit this via the /api/entries/{formId} endpoint to dump database contents, extract credentials, or manipulate data. Time-based blind SQLi confirmed via SLEEP() injection with 3-second delays, and error-based extraction confirmed via extractvalue() technique. Patched in version 4.6.1. EPSS data not available; no CISA KEV listing identified at time of analysis.

Technical ContextAI

YesWiki is a PHP-based wiki platform using MySQL/MariaDB for data persistence. The bazar module provides form-based content management through the EntryManager service class. The vulnerability is a classic CWE-89 SQL injection flaw where user-controlled input from $_POST['id_fiche'] flows directly into mysqli_query() via dbService->loadSingle() without parameterized queries or escaping. The codebase includes an escape() method that is NOT invoked on this code path. The affected SQL query template is: SELECT MIN(time) as firsttime FROM wiki_pages WHERE tag='[UNSANITIZED_INPUT]'. PHP's mysqli extension is used but without prepared statements. The /api/entries/{formId} REST endpoint enforces only minimal ACL (acl:{+} = any authenticated user) before passing POST data to EntryManager::formatDataBeforeSave(). CPE identifies yeswiki:yeswiki product line; all versions prior to 4.6.1 are affected.

RemediationAI

Upgrade to YesWiki version 4.6.1 immediately, released at https://github.com/YesWiki/yeswiki/releases/tag/v4.6.1 which patches the SQL injection via parameterized queries or proper input escaping in EntryManager.php. For Composer-managed installations, update the yeswiki/yeswiki package to >=4.6.1. If immediate patching is not feasible, implement compensating controls: (1) Restrict access to /api/entries/* endpoints via web application firewall rules to trusted IP ranges only, though this reduces wiki collaboration functionality. (2) Disable the bazar module entirely if form-based content management is not required-this breaks form submission features but eliminates the attack surface. (3) Implement database-level read-only permissions for the YesWiki database user to prevent data manipulation, though this may cause application errors during legitimate write operations and does not prevent data exfiltration. (4) Deploy intrusion detection signatures monitoring for SQL injection patterns in id_fiche POST parameters (regex: SLEEP\(|extractvalue\(|UNION SELECT) with alert thresholds, accepting false positives from legitimate entry IDs. Note that none of these workarounds fully mitigate the vulnerability-patching to 4.6.1 is the only complete solution. Refer to vendor advisory https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f58v-p6j9-24c2 for technical details.