CVE-2026-52775: 
PHP vulnerability analysis and mitigation

CVE-2026-52775 is an authenticated SQL injection vulnerability in YesWiki's ReactionManager::deleteUserReaction() function, allowing any authenticated user to inject arbitrary SQL via URL path parameters. It affects all versions of yeswiki/yeswiki (Composer package) prior to 4.6.6. The vulnerability was originally published on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (Github Advisory, YesWiki Advisory).

The root cause is CWE-89 (SQL Injection) — raw string concatenation of user-supplied URL path parameters ({idreaction} and {id}) directly into a SQL LIKE clause within TripleStore::delete() (line 356 of includes/services/ReactionManager.php). The API route /api/reactions/{idreaction}/{id}/{page}/{username} (defined in includes/controllers/ApiController.php line 726) uses ACL "+", meaning any authenticated user can reach it via an HTTP DELETE request. Critically, the if branch of the same function correctly applies $this->dbService->escape(), but the else branch — the vulnerable code path — does not, representing an inconsistent application of input sanitization. A time-based blind SQL injection variant via the {id} parameter is also possible for data exfiltration (Github Advisory, YesWiki Advisory).

Successful exploitation grants full database read and write access to any self-registered (low-privilege) user. An attacker can extract sensitive data including yeswiki_users password hashes and email addresses, modify or delete database records, and potentially disrupt service availability. This vulnerability is a sibling of CVE-2026-46670 (unauthenticated SQLi in FormManager::create()), and both share the same root cause of raw SQL string concatenation across different components (Github Advisory).

A public proof-of-concept is included in the advisory: DELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker with a valid session cookie. The EPSS score is 0.034% (11th percentile), indicating low current exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog. The CVE status remains "Reserved" as of the advisory publication date (Github Advisory).

1. Obtain authentication: Register or obtain credentials for any user account on the target YesWiki instance (ACL "+" permits any authenticated user).
2. Authenticate: Log in to the YesWiki instance and capture the session cookie from the browser or via a login request.
3. Identify the vulnerable endpoint: Confirm the target is running yeswiki/yeswiki < 4.6.6 and that the reactions API is accessible at /wiki/?api/reactions/{idreaction}/{id}/{page}/{username}.
4. Craft the injection payload: URL-encode a SQL injection string for the {idreaction} parameter, e.g., x' OR 1=1 OR value LIKE '/test/SomePage/attacker → x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker.
5. Send the malicious DELETE request: Issue DELETE /wiki/?api/reactions/x%27%20OR%201=1%20OR%20value%20LIKE%20%27/test/SomePage/attacker with the session cookie set in the Cookie header.
6. Exfiltrate data via time-based blind injection: Use the {id} parameter with time-based payloads (e.g., SLEEP() or BENCHMARK()) to extract password hashes and emails from the yeswiki_users table character by character (Github Advisory, YesWiki Advisory).

• Network: Unusual HTTP DELETE requests to /wiki/?api/reactions/ endpoints containing URL-encoded SQL metacharacters (e.g., %27, %20OR%20, %20LIKE%20, SLEEP, BENCHMARK) in path parameters.
• Logs: Web server access logs showing DELETE requests to the reactions API with anomalous or oversized {idreaction} or {id} path segments; repeated requests with slight parameter variations indicative of blind SQL injection enumeration.
• Database: Unexpected or high-volume query activity against the yeswiki_triples or yeswiki_users tables; queries containing LIKE clauses with injected SQL logic; time-delayed query execution patterns consistent with SLEEP()-based blind injection.
• Application: Authentication events from newly self-registered accounts followed immediately by DELETE requests to the reactions API.

Upgrade yeswiki/yeswiki to version 4.6.6 or later, which applies $this->dbService->escape() to all parameters in the vulnerable else branch of ReactionManager::deleteUserReaction() (commit 90ca54f) (Github Commit). As a temporary workaround, restrict user self-registration to limit the pool of authenticated users who can reach the ACL "+" endpoint. The advisory also recommends auditing all TripleStore::delete() callers that pass $extraSQL to identify any additional unsanitized code paths (Github Advisory).

The vulnerability was discovered and reported by Kai Aizen / SnailSploit (finder: 0xShemesh) and published by YesWiki maintainer mrflos on June 2, 2026. No significant broader media coverage or notable public commentary beyond the advisory itself has been identified at this time (YesWiki Advisory).