YesWiki through the latest development branch prior to version 4.6.6 has an authenticated SQL injection vulnerability in ReactionManager::deleteUserReaction(). The vulnerability arises because the {idreaction} and {id} URL path parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization in the else branch of the code, whereas the if branch properly escapes inputs. This flaw allows any authenticated user to inject arbitrary SQL commands, leading to full database read/write capabilities. The root cause is inconsistent use of input escaping in TripleStore::delete() calls. A proof of concept demonstrates a time-based blind SQL injection via the {id} parameter. The vulnerability is related to CVE-2026-46670 but affects a different component.

An authenticated attacker can exploit this vulnerability to perform arbitrary SQL injection, resulting in full read and write access to the database. This includes the ability to extract sensitive information such as user password hashes and email addresses from the yeswiki_users table. The impact is high as it compromises confidentiality, integrity, and availability of the database.

No official patch is currently documented. The suggested fix is to apply proper escaping using $this->dbService->escape() to all parameters in the vulnerable code path, matching the escaping used in the safe code path. Additionally, an audit of all TripleStore::delete() callers that pass extra SQL parameters is recommended to ensure no other injection vectors exist. Until a patch is released, restrict authenticated user permissions if possible and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.