YesWiki EUVD-2026-91468

Requires a MySQL/MariaDB backend (the exploit specifically abuses MySQL backslash escaping to break quote parity) and the ability to save Bazar filtertags markup into a page - available to unauthenticated users only on default installations where page creation/editing is open. The limiting factors are therefore: (1) the database must be MySQL-family for the backslash-escaping trick to work; (2) if the deployment restricts page editing to authenticated users, the unauthenticated path is closed; and (3) affected versions are strictly before 4.6.7. On an out-of-the-box YesWiki install with open editing and MySQL, no authentication or user interaction is needed.

This is a genuine high-priority issue, not an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, and the description independently corroborates this ('Unauthenticated attackers on default installs'), so the network/no-auth signals are consistent across sources. Vulnerable-system confidentiality is High (VC:H) because the UNION subquery reads arbitrary tables including password hashes, while integrity and availability impact are Low (VI:L/VA:L). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is currently theoretical despite the easy preconditions - the absence of these signals is notable given the attack is unauthenticated against default installs and was reported by a credible research vendor (VulnCheck). One nuance to verify: the attack is technically a two-step flow (the attacker must first save filtertags markup into a page, then trigger the filtertags action), yet CVSS still rates AC:L; the backslash-quote-parity trick is reliable under MySQL but the overall vector is sound. Prioritize patching because the impact is credential disclosure and no authentication barrier exists.

An unauthenticated attacker visits a default YesWiki install and saves Bazar filtertags markup containing a filterN token ending in a trailing backslash, breaking quote parity in the raw 'tags.value IN (...)' SQL clause under MySQL backslash escaping. They then trigger the filtertags action to execute an injected five-column UNION subquery, extracting password hashes or other sensitive table data. No public exploit code was identified at time of analysis, but the preconditions are trivial on default configurations.