YesWiki SQL injection leaks all credentials (CVE-2026-46670)

Patch now - CVE-2026-46670 is a critical SQL injection vulnerability in YesWiki versions prior to 4.6.4 that lets any unauthenticated visitor read the entire database, including yeswiki_users.password hashes. Patched in version 4.6.4 - update immediately.

Overview

YesWiki is a popular open-source wiki system written in PHP, commonly used for collaborative documentation and community knowledge bases. The vulnerability exists in the Bazar form-import path, specifically within the FormManager::create() function. Because the flaw requires no authentication and no user interaction, any visitor who can reach a default YesWiki installation can exploit it remotely.

The injection occurs in an INSERT statement, meaning attackers are not limited to reading data. They can also manipulate the database, potentially creating new admin accounts, modifying wiki content, or planting persistent backdoors for later use. In a default installation, the application connects to the database with sufficient privileges to perform these destructive operations.

Impact

Successful exploitation grants the attacker complete read access to the YesWiki database. The most sensitive data stored is the yeswiki_users table, which contains password hashes for all registered users. While YesWiki uses salted hashing, offline cracking of weak or reused passwords remains a realistic threat.

Beyond credential theft, the attacker can:

• Create new administrator accounts and take full control of the wiki
• Modify or delete arbitrary wiki content
• Exfiltrate any other data stored in the database
• Potentially pivot to the underlying server if the database user has file-write privileges

Remediation

YesWiki has released version 4.6.4, which fixes the vulnerable code path. Upgrade all installations immediately:

1. Back up your database and wiki files
2. Update to YesWiki 4.6.4 or later
3. Verify the update applied correctly by testing the Bazar form-import feature

For installations that cannot be patched immediately, consider the following temporary mitigations:

• Restrict network access to the YesWiki web interface
• Place the application behind a Web Application Firewall (WAF) with SQL injection detection rules
• Monitor database logs for anomalous INSERT statements originating from the web application user

Organizations using YesWiki should also audit user accounts for unauthorized changes after upgrading, as the vulnerability may have already been exploited. Review recent database activity for suspicious entries. For broader threat context, refer to our breach reports and security news sections.

Security Insight

This vulnerability follows a familiar pattern: a feature designed for user convenience (form imports) introduced a database layer flaw that turned a low-trust input path into a full data breach. The severity of CVE-2026-46670 - critical with a 9.8 CVSS score - underscores how privilege boundaries in open-source collaboration tools are often assumed rather than enforced. YesWiki’s quick patch window (pre-4.6.4 to 4.6.4) is commendable, but the architecture that allowed an unauthenticated INSERT injection should prompt a broader review of all user-facing database interactions in the codebase.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs