CVE-2026-52770

YesWiki before 4.6.6 contains an unauthenticated SQL injection (CWE-89) in its public Bazar entry-listing APIs. An attacker who can reach these endpoints over the web can supply crafted values in numeric 'query'/'queries' filters that are escaped but inserted into the SQL statement without quotes or numeric validation, allowing boolean SQL expressions to be injected. By observing which entries are returned, the attacker can infer database contents, with high confidentiality impact but no integrity or availability impact. Any deployment running a version prior to 4.6.6 with Bazar list APIs exposed without authentication is affected, which is a common configuration for this self-hosted wiki. Exploitation has not been reported in the wild, no public proof-of-concept is known, and the issue is not in CISA KEV (EPSS ~0.3%).

What to do: Upgrade to YesWiki 4.6.6 or later. If patching is delayed, restrict or authenticate public access to the Bazar entry-listing endpoints (or apply WAF rules validating that the query/queries filter values are strictly numeric) and review web access logs for anomalous filtering patterns. Confirm the deployed version before treating the issue as remediated.