The recentchanges action in YesWiki improperly handles the period argument from the action invocation parameter space, bypassing whitelist validation applied only to the URL query parameter. This unvalidated input is directly interpolated into a SQL query in PageManager::getRecentlyChanged() without escaping or parameter binding, enabling UNION-based SQL injection. Because the injection is stored in a page, any user viewing that page triggers the injection and sees exfiltrated data rendered as page links. The default write ACL allows anonymous users to save such a trigger page, making the vulnerability broadly exploitable.

An attacker with permission to save pages (including anonymous users on default installs) can inject SQL code that is executed whenever the page is viewed, resulting in arbitrary read access to the YesWiki database. This can expose sensitive data such as user credentials or other confidential information accessible to the database user. The vulnerability does not allow modification or deletion of data, only reading.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write permissions to trusted users only to prevent injection of malicious recentchanges action parameters. Avoid using the recentchanges action with untrusted input in page content. Monitor vendor channels for an official patch.