PT-2026-37109 · Yeswiki · Yeswiki

Morimori-Dev · Published 2026-04-18 · Updated 2026-05-07 · CVE-2026-41143

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.1

Description The bazar module contains a SQL injection flaw in the tools/bazar/services/EntryManager.php file. The issue occurs because the id fiche value, sourced from the $ POST['id fiche'] variable, is concatenated directly into a raw SQL query without sanitization or parameterization. This allows an authenticated user to execute arbitrary SQL commands via the '/api/entries/{formId}' endpoint by manipulating the id fiche parameter. The vulnerability is triggered within the create() function, which calls formatDataBeforeSave(), eventually passing the unsanitized input to the loadSingle() function.

Recommendations Update to version 4.6.1. As a temporary workaround, restrict access to the '/api/entries/{formId}' endpoint or avoid using the id fiche parameter until the update is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-41143

GHSA-F58V-P6J9-24C2

Affected Products

Yeswiki

References · 9

• 🔥 https://github.com/YesWiki/yeswiki/security/advisories/GHSA-f58v-p6j9-24c2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41143 · Security Note
• https://osv.dev/vulnerability/GHSA-f58v-p6j9-24c2 · Vendor Advisory
• https://github.com/YesWiki/yeswiki · Note
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.1 · Note
• https://twitter.com/CVEnew/status/2052400806541087188 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1t6ale4/critical_sql_injection_flaw_discovered_in_yeswiki · Reddit Post
• https://twitter.com/KaitanSecurity/status/2052282301933818329 · Twitter Post
• https://t.me/CVEtracker/52948 · Telegram Post