Packagist · yeswiki/yeswiki
YesWiki has Authenticated SQL Injection via ReactionManager
YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization.
This is a sibling of CVE-2026-46670 (unauthenticated SQLi in FormManager::create()). Both share the same root cause — raw string concatenation into SQL queries — but exist in different components.
includes/controllers/ApiController.php line 726:
/**
* @Route("/api/reactions/{idreaction}/{id}/{page}/{username}", methods={"DELETE"}, options={"acl":{"+"}})
*/
ACL "+" = any authenticated user. Parameters flow into ReactionManager::deleteUserReaction() → TripleStore::delete() with raw string concatenation into SQL LIKE clause (line 356).
The if branch (lines 340-354) properly uses $this->dbService->escape(). The else branch does not — the developer applied escaping to one code path but not the other.
DELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker
Host: localhost:8085
Cookie: <session cookie>
Time-based blind variant via {id} parameter for data exfiltration.
Full database read/write. Any self-registered user can extract yeswiki_users password hashes and emails.
Apply $this->dbService->escape() to all parameters in the else branch, matching the if branch pattern. Also audit all TripleStore::delete() callers that pass $extraSQL.
Kai Aizen / SnailSploit
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.