CVE-2026-52771

YesWiki versions 4.2.0 through versions before 4.6.6 contain a SQL injection (CWE-89) in ApiController::deletePage(), where a page tag read from the database is interpolated unescaped into a DELETE FROM ..._links WHERE to_tag = '$tag' query. The tag is attacker-controlled: the POST /api/pages/{tag} endpoint accepts arbitrary URL-encoded values, including single quotes, and stores them in the database. A low-privilege authenticated user can create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database, including time-based blind exfiltration of data from any table. Any YesWiki deployment running an affected version that exposes the API to low-privileged accounts is affected; the flaw is rated 8.3 (high) with high confidentiality and integrity impact. No public proof-of-concept is known, EPSS is low (0.3% probability of exploitation within 30 days), and the issue is not in CISA KEV, so no confirmed exploitation is currently known.

What to do: Upgrade to YesWiki 4.6.6 or later. Where upgrading is not immediately possible, restrict API access so that low-privileged accounts cannot create pages via POST /api/pages/{tag}, and audit existing page tags for embedded quotes or SQL metacharacters. Because time-based blind exfiltration from any table is possible, review database logs for unusually long-running or unexpected queries involving the _links table.