External risk intelligence

YesWiki Bazar Form-Import SQL Injection Allows Database Read

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-46670

YesWiki is a web-based wiki application designed to be accessible to users. As a web application, it is commonly deployed as a public-facing service to facilitate collaborative content management, making the form-import path reachable by external visitors in typical deployments.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in YesWiki, a PHP-based wiki system. The issue allows unauthenticated users to inject malicious SQL code, potentially granting access to the entire database, including user credentials. The primary concern is confirming if this technology is in use and exposed externally.

Unauthenticated database access via wiki system.
Critical vulnerability could expose user credentials.
Confirm relevance and assess exposure to YesWiki.

Attack Path

How an attacker could exploit the issue

An unauthenticated visitor could target a default YesWiki installation. By submitting specially crafted data to the form-import feature, an attacker could inject malicious SQL commands. This could allow them to read sensitive information from the database, including user password hashes.

No authentication needed.
Uses form-import feature.
Read database and user passwords.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to read the entire YesWiki database. When the Bazar form-import feature is used on a default installation, arbitrary SQL can be injected into an INSERT statement. This could expose sensitive user information, including password hashes.

User data, including password hashes.
SQL injection via form-import path.
Full database read access.

Operational Fix

Recommended remediation, mitigation, and detection steps

YesWiki, being a PHP-based wiki system, typically falls under the purview of application owners or platform teams responsible for its deployment and maintenance. The first critical step is to identify all YesWiki instances, confirm their exposure and business criticality, and then ascertain the accountable owner for each. This will enable a risk-based approach to remediation, prioritizing actions based on the potential impact.

Application owners should manage this.
Verify all YesWiki instances.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YesWiki and how is it used?

YesWiki is a collaborative content management system built with PHP. It allows users to create wikis, manage databases, and organize information through various modular extensions, such as the Bazar plugin used for data collection and forms.

What does CVE-2026-46670 mean for security?

This vulnerability is a SQL injection (CWE-89) flaw. It means an attacker can send malicious commands to the database instead of the expected data, tricking the application into revealing private information like user password hashes.

How can an attacker trigger this vulnerability?

An attacker triggers this by interacting with the Bazar form-import path in YesWiki. It does not require login credentials to execute. However, this path is only a risk if the Bazar plugin is enabled and reachable; installations without this specific feature active are not affected by this path.

Is my YesWiki instance at risk?

According to Halo Surface Signal, YesWiki is commonly deployed as a public-facing service. If your instance is accessible over the internet, it is at higher risk because the vulnerable form-import path is reachable by external visitors without requiring any authentication.

What should I do if I run YesWiki?

The most important step is to identify all instances of YesWiki in your environment and determine who manages them. Once located, verify if they are running a version prior to 4.6.4 and coordinate with your team to update to the latest patched release.

References

github.com/YesWiki/yeswiki/security/advisories/GHSA-jwvv-qr7q-cv8j

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.