What is the CVSS score of CVE-2026-52775?

CVE-2026-52775 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-52775?

Yes, a public proof-of-concept exploit is available for CVE-2026-52775. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-52775?

Yes, a patch is available for CVE-2026-52775. Update the affected software to the latest version immediately.

PHP CVE-2026-52775

HIGH

SQL Injection (CWE-89)

2026-07-09 https://github.com/YesWiki/yeswiki

GHSA-4pf7-cc4r-g63h

PHP SQLi

8.8

CVSS 3.1 · Vendor: https://github.com/YesWiki/yeswiki

Severity by source

Vendor (https://github.com/YesWiki/yeswiki) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network API reachable with a self-service low-privilege account (PR:L), no user interaction, and unparameterized SQL yields full DB read/write, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/YesWiki/yeswiki).

CVSS VectorVendor: https://github.com/YesWiki/yeswiki

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 10:52 vuln.today

Analysis Generated

Jul 09, 2026 - 21:47 vuln.today

CVE Published

Jul 09, 2026 - 21:02 github-advisory

HIGH 8.8

DescriptionCVE.org

Summary

YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.

This is a sibling of CVE-2026-46670 (unauthenticated SQLi in FormManager::create()). Both share the same root cause - raw string concatenation into SQL queries - but exist in different components.

Root Cause

includes/controllers/ApiController.php line 726:

php

/**
 * @Route("/api/reactions/{idreaction}/{id}/{page}/{username}", methods={"DELETE"}, options={"acl":{"+"}})
 */

ACL "+" = any authenticated user. Parameters flow into ReactionManager::deleteUserReaction() → TripleStore::delete() with raw string concatenation into SQL LIKE clause (line 356).

The if branch (lines 340-354) properly uses $this->dbService->escape(). The else branch does not - the developer applied escaping to one code path but not the other.

PoC

DELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker
Host: localhost:8085
Cookie: <session cookie>

Time-based blind variant via {id} parameter for data exfiltration.

Impact

Full database read/write. Any self-registered user can extract yeswiki_users password hashes and emails.

Suggested Fix

Apply $this->dbService->escape() to all parameters in the else branch, matching the if branch pattern. Also audit all TripleStore::delete() callers that pass $extraSQL.

Credits

Kai Aizen / SnailSploit

AnalysisAI

Authenticated SQL injection in YesWiki allows any logged-in user to read and write the entire database by sending a malicious DELETE request to the reactions API. The flaw affects all versions through the latest development branch and has a publicly available proof-of-concept exploit. There is no evidence of active exploitation in the wild, but the ease of attack and high impact make this a critical patch priority.