YesWiki EUVD-2026-91473

Requires that the attacker can write/edit a page that invokes the Bazar nuagetag action; on default YesWiki installations page-write access is open to unauthenticated users, enabling remote exploitation without credentials. Exploitation specifically depends on the nuagetag action concatenating the unescaped tags attribute into a raw SQL IN clause, triggered by a tag value ending in a backslash to break quote parity. Limiting factors: installations that restrict page-write access (authentication or ACLs on editing) raise the privilege requirement and substantially reduce exposure, and only versions before 4.6.7 are affected.

This is a genuinely high-priority flaw where multiple signals align. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity exploitation requiring no privileges or user interaction, which is consistent with the description's note that page-write access is unauthenticated on default YesWiki installs. Primary impact is confidentiality (VC:H) - exfiltration of password hashes and arbitrary table data - with limited integrity and availability impact (VI:L/VA:L), fitting a UNION-based SQL injection that reads rather than writes. A vendor patch exists and the issue was reported by a credible source (VulnCheck). The main dampener on real-world risk is deployment footprint: YesWiki is a niche product, so this is a serious vulnerability in a limited population rather than a mass-exploitation event. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation remains theoretical-but-easy at time of analysis; the low-complexity, unauthenticated nature means weaponization would be straightforward if the product were more widespread. No conflicting signals were detected between the vector and the description.

An attacker reaches a default-configured YesWiki instance where page editing is open to anonymous users, and creates or edits a page invoking the Bazar nuagetag action with a tags attribute ending in a backslash to break SQL quote parity. The injected UNION subquery runs against the backend database, returning user password hashes and other table contents in the rendered tag cloud. No authentication or user interaction is required on default installs, and no public exploit code was identified in the provided data.