CVE-2026-52771 - YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (ApiController::deletePage)
CVE-2026-52771 + YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (ApiController::deletePage) + High + 2026-07-09
One-sentence business risk
Attackers can turn a normal application path into code execution, making this a direct production-host takeover risk.
Research notes
- Root cause: ## Summary
ApiController::deletePage()interpolates a page tag retrieved from the database into aDELETE FROM …_links WHERE to_tag = '$tag'query without escaping. - Affected versions: composer:yeswiki/yeswiki >= 4.2.0, < 4.6.6.
- Fixed / safe versions: 4.6.6.
- Public exploit / PoC signal: the consulted NVD/GHSA/vendor sources describe the trigger class; treat it as reproducible until patched.
- CVSS: use upstream advisory score .
Exact vulnerable code pattern
Python: cursor.execute("SELECT * FROM docs WHERE body LIKE '%" + q + "%'")
Node: db.query("SELECT * FROM docs WHERE body LIKE '%" + req.query.q + "%'")
Java: stmt.executeQuery("SELECT * FROM docs WHERE body LIKE '%" + userInput + "%'")
Fixed / mitigated code pattern
Python: cursor.execute("SELECT * FROM docs WHERE body LIKE %s", (f"%{q}%",))
Node: db.query("SELECT * FROM docs WHERE body LIKE ?", [`%${req.query.q}%`])
Java: ps = conn.prepareStatement("SELECT * FROM docs WHERE body LIKE ?"); ps.setString(1, "%" + userInput + "%")
Dependency or runtime update:
composer show yeswiki/yeswiki || true
composer require yeswiki/yeswiki --with-all-dependencies
composer audit
Step-by-step integration guide
- Inventory
yeswiki/yeswikiacross source, lockfiles, SBOMs, container images, CI images, and deployment manifests. - Upgrade to
4.6.6or apply the exact vendor patch referenced below. - Replace the vulnerable
sql-injectionpattern with the fixed pattern and fail closed on malformed input. - Add a regression test that exercises the advisory trigger and proves the request is rejected, bounded, or authorized.
- Deploy through canary, monitor security logs and resource metrics, then remove temporary edge blocks only after all runtimes are fixed.
Alternative mitigations
- Disable the vulnerable feature path while the package/runtime update rolls out.
- Add WAF or reverse-proxy rules for traversal tokens, prototype-polluting keys, oversized frames, shell metacharacters, or unauthenticated tool calls matching the trigger class.
- Restrict internal egress, rotate exposed secrets, and revoke affected tokens/keys if the vulnerability can disclose config, logs, JWT secrets, proxy credentials, or PKI material.
- For admin/API authorization issues, temporarily require elevated roles and explicit ownership checks at the gateway.
Detection signature
id: cve-2026-52771-yeswiki-second-order-sql-injection-in-page-delet
source: "GitHub Advisory Database"
dependency_or_product: "yeswiki/yeswiki"
affected: "composer:yeswiki/yeswiki >= 4.2.0, < 4.6.6"
fixed: "4.6.6"
signals:
- "sql-injection"
- "../"
- "__proto__"
- "tools/call"
- "wp_ajax_nopriv"
- "pickle.loads"
- "shell command construction"
action: "upgrade, add regression test, and verify deploy artifact"
Copy-paste skill
You are remediating CVE-2026-52771 (YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (ApiController::deletePage)) in this repository.
Find every affected dependency, runtime, image, service configuration, and reachable code path. Upgrade or patch to 4.6.6. Replace the vulnerable sql-injection pattern with a fail-closed implementation, add a regression test for the trigger shape, and update deployment/SBOM artifacts. If this repository does not control the affected runtime, create TRIAGE.md naming the owner, affected version, fixed version, and blocking decision.
Keywords, affected tech stack, and revenue tags
- Keywords:
CVE-2026-52771,sql-injection,yeswiki/yeswiki,GitHub Advisory Database. - Affected tech stack:
php/composer. - Revenue tags:
sellable_to_fintech,enterprise_blocker,high_priority_sla.