CVE-2026-46670 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-46670 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-46670 is a critical unauthenticated SQL injection in YesWiki’s Bazar form-import path. A default YesWiki install can be abused by any remote visitor to inject SQL through FormManager::create(), potentially exposing the full database, including yeswiki_users.password hashes, emails, and other sensitive content. This issue is present in yeswiki/yeswiki 4.6.1, 4.6.2, and current doryphore-dev based on analysis of upstream commit 1f485c049db030b94c047ec219e63534ac81142e.

This is not currently marked as known-exploited in the wild, but the attack is straightforward and unauthenticated, so solo developers and small teams should treat it as urgent.

Immediate Action

  • Upgrade immediately to a fixed YesWiki release as soon as the vendor publishes one. TODO: replace with the official advisory and fixed version link: vendor advisory.
  • If you cannot patch today, take the site offline or restrict access to trusted IPs/VPN only until remediation is complete.
  • Disable or remove Bazar form-import functionality if your deployment does not need it.
  • Rotate credentials if the site may have been exposed: admin accounts, database user, API keys, and any passwords stored in the wiki database.
  • Back up the database before changes, then verify integrity after patching.
  • Monitor logs for requests to /?BazaR&vue=formulaire and unusual payloads containing SQL operators, ASCII(SUBSTRING(...)), or HEX(VERSION()).

Affected Versions

  • composer yeswiki/yeswiki 4.6.1 vulnerable
  • composer yeswiki/yeswiki 4.6.2 vulnerable
  • composer yeswiki/yeswiki doryphore-dev vulnerable
  • Safe version: TODO_FIXED_VERSION or later, once the upstream patch is released and confirmed

Resolution Guide

Composer / PHP

composer show yeswiki/yeswiki
composer update yeswiki/yeswiki --with-all-dependencies
# or pin to a fixed release once known:
composer require yeswiki/yeswiki:TODO_FIXED_VERSION

Docker

# Pull a patched image tag once published
docker pull TODO_YESWIKI_PATCHED_IMAGE:TODO_TAG

# If you build from source, rebuild after updating the dependency
docker compose build --no-cache
docker compose up -d

Linux package managers

# If your deployment is packaged by your distro or internal repo:
apt-cache policy yeswiki
sudo apt-get update
sudo apt-get install --only-upgrade yeswiki

# RHEL/Fedora/CentOS-style
yum info yeswiki
sudo yum update yeswiki

Hardening while waiting for a patch

# Put the app behind a reverse proxy allowlist or VPN
# Example nginx allowlist
location / {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}

Code fix example

If you maintain a fork or need to review the patch, the vulnerable pattern is unquoted concatenation of bn_id_nature into an SQL INSERT. Replace string building with parameterized queries and strict type validation:

// Vulnerable: direct concatenation
// $sql = "INSERT INTO yeswiki_nature (..., bn_id_nature, ...) VALUES ($bn_id_nature, ...)";

// Safer: validate and bind
$bn_id_nature = filter_var($bn_id_nature, FILTER_VALIDATE_INT);
if ($bn_id_nature === false) {
    throw new InvalidArgumentException('Invalid nature ID');
}

$stmt = $pdo->prepare(
    'INSERT INTO yeswiki_nature (bn_id_nature, bn_label_nature, bn_template, bn_description, bn_condition)
     VALUES (:bn_id_nature, :bn_label_nature, :bn_template, :bn_description, :bn_condition)'
);
$stmt->execute([
    ':bn_id_nature' => $bn_id_nature,
    ':bn_label_nature' => $bn_label_nature,
    ':bn_template' => $bn_template,
    ':bn_description' => $bn_description,
    ':bn_condition' => $bn_condition,
]);

Detection & Verification

Check your installed version

composer show yeswiki/yeswiki | sed -n '1,20p'
grep -R "1f485c049db030b94c047ec219e63534ac81142e" -n .

Search for the vulnerable sink

grep -R "FormManager::create" -n tools/bazar/services/
grep -R "bn_id_nature" -n tools/bazar/services/FormManager.php

Look for suspicious requests in logs

grep -R "BazaR&vue=formulaire" /var/log/nginx /var/log/apache2 2>/dev/null
grep -R "ASCII(SUBSTRING" /var/log/nginx /var/log/apache2 2>/dev/null
grep -R "HEX(CONCAT" /var/log/nginx /var/log/apache2 2>/dev/null

Verify the fix

# After patching, the app should reject crafted payloads and no longer accept SQL expressions in bn_id_nature.
# Confirm the version:
composer show yeswiki/yeswiki
# Confirm the code path now uses parameterized queries:
grep -R "prepare(" -n tools/bazar/services/FormManager.php

Risk and Impact

This flaw allows a remote attacker to read the database without authentication. In a default YesWiki deployment, that can expose usernames, email addresses, password hashes, and any other stored content or metadata. Because the injection occurs in a form-import path, the blast radius includes any internet-facing instance that leaves Bazar enabled.

Even though there are no current reports of exploitation in the wild, the attack is low-complexity and high-impact. Small teams should prioritize patching, access restriction, and credential rotation immediately.

Keep reading