CVE-2026-116820: YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-31
Weakness: CWE-215

Description

YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection.

Affected products

yeswiki: from 4.6.0 before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: yeswiki 4.7.0. Check the vendor advisory for mitigations.

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm
https://www.vulncheck.com/advisories/yeswiki-from-4.6.0-before-4.7.0-sql-query-disclosure-via-showreq-parameter
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-98mc-h829-5hwm

Get alerted when CVE-2026-116820 or the next vulnerability affects your stack