CVE-2026-52775

YesWiki, a PHP-based wiki platform, is vulnerable to SQL injection (CWE-89) in ReactionManager::deleteUserReaction() that lets any authenticated user execute arbitrary SQL against the backend database. The flaw is triggered by embedding crafted values in the {idreaction} and {id} URL path parameters, which are concatenated directly into a SQL LIKE clause without escaping or parameterized queries. A successful attacker can read, modify, or delete database content, consistent with the high confidentiality, integrity, and availability impact reflected in the 8.8 CVSS score. All YesWiki deployments running versions prior to 4.6.6, including the latest development branch, are affected. Exploitation has not been observed: there is no known public proof of concept, the EPSS probability is 0.3 percent (21st percentile), and the flaw is not in the CISA KEV catalog.

What to do: Upgrade to YesWiki 4.6.6 or later, where the affected SQL query is parameterized. Until upgrading, audit access logs for requests to the affected endpoint containing SQL metacharacters in the {idreaction} and {id} path parameters and consider WAF rules that reject quotes or SQL keywords there; because authentication is required, ensure least-privilege database credentials limit damage if exploited.