Unrated

Authenticated SQL Injection in YesWiki ReactionManager::deleteUserReaction()

IdentifiersCVE-2026-52775CWE-89

CVE-2026-52775 is an authenticated SQL injection vulnerability in YesWiki affecting the reactions API. The flaw is present in ReactionManager::deleteUserReaction(), where user-controlled idreaction and id values supplied through URL path parameters can reach a database deletion path without proper escaping or parameterization in one code branch. The vulnerable logic differs from a protected branch that correctly handles parameters, creating an injection condition in the alternate path. Successful exploitation allows an authenticated attacker to manipulate backend SQL queries and interact with application data beyond the intended scope of the API operation.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated attacker to obtain arbitrary database read and write capabilities within the application's database context. This can enable extraction of sensitive records, including user account data such as password hashes and email addresses, as well as unauthorized modification or deletion of stored content. Depending on database permissions and application trust in stored data, the vulnerability may also support broader application compromise, integrity loss, and service disruption.

Mitigation

If you can’t patch tonight, do this now.

Until a fixed release can be deployed, restrict or disable access to the vulnerable reactions API endpoint, especially for low-trust authenticated users. Reduce exposure by limiting self-registration and tightening authenticated access controls. Monitor for suspicious DELETE requests targeting the reactions API that contain SQL metacharacters or anomalous parameter patterns. As a defensive measure, review and harden code paths that pass dynamic conditions into TripleStore::delete(), and apply least-privilege database permissions to reduce the blast radius of successful injection.

Remediation

Patch, then assume compromise.

Upgrade YesWiki to version 4.6.6 or later. If code-level remediation is required, ensure the vulnerable branch in ReactionManager::deleteUserReaction() uses proper parameterized queries or equivalent escaping for all attacker-controlled parameters, including values derived from idreaction and id. The database deletion logic should be aligned with the already protected branch, and related TripleStore::delete() call sites that accept additional SQL fragments should be reviewed and corrected to prevent similar injection paths.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

YeswikiYeswikiapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity