YesWiki EUVD-2026-109467

Unauthenticated exploitation requires a DEFAULT YesWiki install (versions 4.5.0 through at least 4.6.7): Bazar module ACL left at the default *, use_captcha:false (default per tools/security/config.yaml), and bazarIgnoreAcls:true (default), which together let EntryController::create() reach the sink via POST action=saisir_fiche with SQL metacharacters in the reserved date_maj_fiche field. The double-quote breakout further requires MySQL/MariaDB sql_mode with ANSI_QUOTES OFF (the default). An alternative authenticated path (POST /?api/entries/{formId}) needs only any registered account to satisfy the + route ACL. LIMITING FACTORS: mysqli provides no stacked-query support, so impact is confined to a read oracle (direct storage of a sub-SELECT result or blind time-based extraction) rather than arbitrary write/delete; hardened installs that restrict the Bazar module ACL, enable captcha, or set bazarIgnoreAcls:false remove the unauthenticated path and force the authenticated route.

Signals point consistently toward a genuine, near-term priority rather than a high-CVSS paper tiger. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, and the GHSA source evidence independently confirms an unauthenticated default-config path (module ACL *, use_captcha:false, bazarIgnoreAcls:true) reaching the same sink - so the PR:N claim is corroborated by mechanism, not just asserted. vuln.today assigns a 'this_week' decision label and the report originates from VulnCheck, both raising urgency. The GHSA advisory includes a concrete, step-by-step injection payload against wiki_users.password, so the exploitation technique is fully documented publicly even though no formal 'confirmed working exploit' flag is supplied. Tempering factors: there is no CISA KEV listing and no EPSS score in the input, so active-exploitation and statistical-exploitation-likelihood signals are simply MISSING - not low, absent - and should not be read as reassurance. Impact is bounded: mysqli allows no stacked queries, so this is a confidentiality read-oracle (C:H / VC:H) with only a single attacker-controlled row inserted (I:L / VI:L) and no availability impact. Net: credible unauthenticated password-hash disclosure in default installs with a public PoC payload - treat as a real priority, weighted down only by the product's modest deployment footprint and absence of KEV/EPSS confirmation.

An unauthenticated attacker locates a default-configured YesWiki Bazar form and POSTs an entry-creation request (action=saisir_fiche) whose date_maj_fiche field closes the time="..." literal and injects a sub-SELECT against wiki_users, then fetches the created page to read back a username:password-hash pair. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N and the GHSA advisory publishes a full working payload, the attack is network-based, low-complexity, and requires no authentication or user interaction on default installs.