---
id: CVE-2026-52763
title: YesWiki is a wiki system written in PHP
summary: >-
  YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the
  recentchanges action (actions/recentchanges.php) accepts a period argument
  from two disjoint parameter spaces. A whitelist validates only the URL form
  against ['day','w…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
  - CWE-1287
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.6.6
patched:
  - yeswiki/yeswiki 4.6.6
published: '2026-09-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:05:26.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52763'
references:
  - url: 'https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6'
    label: security-advisories@github.com
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-89v6-j5x6-cmj3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/YesWiki/yeswiki/commit/5da27474c3ee62270c8a6b9d7055d494cdbd38e5
  - url: 'https://github.com/advisories/GHSA-89v6-j5x6-cmj3'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
epss: 0.00379
epssPercentile: 0.29317
aliases:
  - GHSA-89v6-j5x6-cmj3
ecosystem: composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-08T16:37:17.266942Z'
ingestedAt: '2026-07-09T21:52:34.702Z'
---

## Overview

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argument from two disjoint parameter spaces. A whitelist validates only the URL form against ['day','week','month']. The action-argument form takes the else branch with no validation, and the value flows into PageManager::getRecentlyChanged(), where it is interpolated into a WHERE time >= '...' ORDER BY time DESC clause without escaping or parameterization. UNION-based injection succeeds, the leaked rows render into the response page, so any visitor of the trigger page sees the exfiltrated data. The vulnerability provides arbitrary read of the YesWiki database to anyone who can save the trigger page. On a default install (default_write_acl='*'), this includes anonymous users, subject to the hashcash JS check on the page-edit form. Once the trigger page is saved, every subsequent view fires the injection as the SQLi is stored. Stored SQL injection is reachable through the page-edit flow, with arbitrary database read. This issue has been patched in version 4.6.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-52763)

Affected packages:

- `yeswiki/yeswiki < 4.6.6`

Patched in:

- `yeswiki/yeswiki 4.6.6`

Source: https://github.com/advisories/GHSA-89v6-j5x6-cmj3