What is the CVSS score of CVE-2026-52775?

CVE-2026-52775 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of YesWiki are affected by CVE-2026-52775?

A SQL injection vulnerability in YesWiki enables complete database access and user credential extraction; publicly available exploit code exists.. A patch is available.

Is there a public PoC exploit available for CVE-2026-52775?

Yes, a public proof-of-concept exploit is available for CVE-2026-52775. Prioritise patching immediately.

How to fix or mitigate CVE-2026-52775?

Within 24 hours: enumerate all YesWiki deployments and document version numbers. Within 7 days: apply the vendor-released patch to all systems. Within 30 days: reset all user passwords and review database access logs for exploitation attempts.

YesWiki CVE-2026-52775

HIGH

SQL Injection (CWE-89)

2026-07-09 https://github.com/YesWiki/yeswiki

GHSA-4pf7-cc4r-g63h

SQLi PHP

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network API reachable with a self-service low-privilege account (PR:L), no user interaction, and unparameterized SQL yields full DB read/write, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 21:47 vuln.today

DescriptionGitHub Advisory

Summary

YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.

This is a sibling of CVE-2026-46670 (unauthenticated SQLi in FormManager::create()). Both share the same root cause - raw string concatenation into SQL queries - but exist in different components.

Root Cause

includes/controllers/ApiController.php line 726:

php

/**
 * @Route("/api/reactions/{idreaction}/{id}/{page}/{username}", methods={"DELETE"}, options={"acl":{"+"}})
 */

ACL "+" = any authenticated user. Parameters flow into ReactionManager::deleteUserReaction() → TripleStore::delete() with raw string concatenation into SQL LIKE clause (line 356).

The if branch (lines 340-354) properly uses $this->dbService->escape(). The else branch does not - the developer applied escaping to one code path but not the other.

PoC

DELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker
Host: localhost:8085
Cookie: <session cookie>

Time-based blind variant via {id} parameter for data exfiltration.

Impact

Full database read/write. Any self-registered user can extract yeswiki_users password hashes and emails.

Suggested Fix

Apply $this->dbService->escape() to all parameters in the else branch, matching the if branch pattern. Also audit all TripleStore::delete() callers that pass $extraSQL.

Credits

Kai Aizen / SnailSploit

AnalysisAI

{idreaction} and {id} URL path parameters, which are concatenated directly into a LIKE clause. Because YesWiki permits open self-registration, the practical barrier is minimal, and the flaw grants full database read/write - including extraction of yeswiki_users password hashes and emails. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Self-register low-privilege account

Delivery

Authenticate and obtain session cookie

Exploit

Send crafted DELETE to /api/reactions path

Execution

Inject SQL into LIKE clause

Persist

Blind-exfiltrate yeswiki_users hashes and emails

Impact

Crack hashes and escalate to admin

Access

Self-register low-privilege account

Delivery

Authenticate and obtain session cookie

Exploit

Send crafted DELETE to /api/reactions path

Execution

Inject SQL into LIKE clause

Persist

Blind-exfiltrate yeswiki_users hashes and emails

Impact

Crack hashes and escalate to admin

Vulnerability AssessmentAI

Exploitation	Requires an authenticated session on the target YesWiki instance (route ACL '+' = any logged-in user, matching CVSS PR:L); no admin or elevated role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: network-reachable, low complexity, requiring only low-privilege authentication, with high impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker self-registers a normal account on an internet-facing YesWiki instance, authenticates, then sends a crafted DELETE request to /wiki/?api/reactions/{idreaction}/{id}/... with SQL payload injected into the path parameters (e.g. …
Remediation	Upstream fix available (commit 90ca54fb518e1c43a1ead6e4f5bf9f0389789841); a released patched version tag was not independently confirmed in the provided data, so apply the fix by updating to the patched commit/branch referenced in advisory GHSA-4pf7-cc4r-g63h (https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4pf7-cc4r-g63h). … Detailed patch versions, workarounds, and compensating controls in full report.