CVE-2026-46670 YesWiki CVE debrief

Who should care

Defenders responsible for YesWiki installations, security teams, and system administrators should be aware of this vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-46670 is a critical SQL injection vulnerability in YesWiki that allows unauthenticated attackers to access sensitive data. Defenders should prioritize patching, verify database integrity, and implement additional security measures to protect against unauthorized access.

• Potential unauthorized access to sensitive data, including password hashes
• Possible exploitation by unauthenticated attackers
• Need for verification of database integrity and system security
• Priority on patching and remediation efforts

Technical summary

The vulnerability exists in the Bazar form-import path of YesWiki, allowing an unauthenticated attacker to inject arbitrary SQL into an INSERT statement and read the full database, including password hashes. This SQL injection vulnerability is a critical issue that requires immediate attention from defenders. The affected product is YesWiki, and the vulnerability is fixed in version 4.6.4. Defenders should prioritize patching YesWiki installations to version 4.6.4 or later, verify database integrity, and consider implementing additional security measures to protect against unauthorized access.

Defensive priority

Defenders should prioritize patching YesWiki installations to version 4.6.4 or later, verify database integrity, and consider implementing additional security measures to protect against unauthorized access.

Recommended defensive actions

• Patch YesWiki installations to version 4.6.4 or later
• Verify database integrity and monitor for suspicious activity
• Implement additional security measures to protect against unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, further verification is required to determine the full scope of affected systems and potential consequences.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.