🚨 CVE-2026-104441
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with partial read-back via the {{valeur}} action
### Summary
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
Any unauthenticated visitor can make the YesWiki server perform HTTP requests to arbitrary
hosts and ports via the `{{valeur}}` wiki action, and parts of the fetched response are
echoe...
🚨 CVE-2026-104442
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
🎖@cveNotify
GitHub
Unauthenticated Server-Side Request Forgery with response read-back via the {{syndication}} action
### Summary
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
Any unauthenticated visitor can make the YesWiki server issue HTTP requests to arbitrary
hosts and ports, including internal/loopback addresses, and read back the fetched feed
content ...
🚨 CVE-2026-104443
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership triple, emptying the admin group and causing a site-wide authorization lockout.
🎖@cveNotify
GitHub
Arbitrary semantic-triple delete/create by any authenticated user via empty-filter scope bypass (admin-group lockout)
## Summary
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
Any user with a low-privilege authenticated account (route ACL `+`) can delete or forge arbitrary semantic triples in YesWiki regardless of ownership, via the triples REST API. Deleting ...
🚨 CVE-2026-104444
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can send a POST request to the api/comments endpoint targeting a victim tag, bypassing per-page write ACLs to replace content and reparent existing pages or comments.
🎖@cveNotify
GitHub
Comments API editComment authorization keyed to attacker-supplied pagetag enables arbitrary page/comment overwrite
## Summary
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
The comments REST API `editComment` route (`POST /api/comments/{tag}`, route ACL `+`) keys its authorization on an attacker-supplied POST field (`pagetag`) instead of on the `{tag}` bein...
🚨 CVE-2026-104445
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
YesWiki before 4.6.7 contains an authentication bypass vulnerability in the ActivityPub inbox that fails to bind the verified HTTP signature signer to the activity actor. Unauthenticated attackers with any ActivityPub keypair can send signed Delete or Update activities referencing a mirrored entry's sourceUrl to delete or overwrite other actors' federated entries.
🎖@cveNotify
GitHub
ActivityPub inbox does not bind the verified signer to the activity actor, allowing cross-actor delete and update
## Summary
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
The ActivityPub inbox verifies that the request carries a valid HTTP signature, then processes the activity body without ever checking that the verified signer is the actor named in tha...
🚨 CVE-2026-104447
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.
🎖@cveNotify
GitHub
CSRF: arbitrary installed-package/extension deletion via GET in autoupdate UpdateAction
## Summary
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
The YesWiki autoupdate action (`{{update}}`, `tools/autoupdate/actions/UpdateAction.php`) deletes an installed package/extension on a **GET** request with **no CSRF token**. An attacker ...
🚨 CVE-2026-104448
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers.
🎖@cveNotify
GitHub
CSRF arbitrary page deletion via GET in ajaxdeletepage handler
## Summary
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
The `ajaxdeletepage` handler (`tools/tags/handlers/page/ajaxdeletepage.php`) permanently deletes a wiki page on a **GET** request with **no CSRF token**. An attacker who lures a logged-i...
🚨 CVE-2026-104449
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry with an attacker-controlled id_fiche matching an existing page, overwriting its body for mass defacement and content destruction.
🎖@cveNotify
GitHub
Unauthenticated arbitrary page overwrite via Bazar entry creation with attacker-controlled id_fiche
## Summary
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
An unauthenticated visitor who reaches any YesWiki page that renders the `{{bazar}}` action can drive it into entry-creation mode via URL query parameters and overwrite the body of ANY e...
🚨 CVE-2026-104450
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers.
🎖@cveNotify
GitHub
Unauthenticated ACL-bypassing arbitrary page write and stored XSS via pointimage action
## Summary
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
The `pointimage` action (`tools/attach/actions/pointimage.php`) lets an **unauthenticated** attacker write to **any** wiki page, bypassing that page's write ACL, and — with the defau...
🚨 CVE-2026-104451
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revisions through GET requests lacking CSRF token validation. Attackers can lure write-capable users into a top-level navigation with the restoreRevisionId parameter, silently overwriting current page content with stale or vandalized revisions.
🎖@cveNotify
GitHub
CSRF: page-revision restore (content overwrite) via GET in RevisionsHandler
## Summary
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
The YesWiki revisions handler (`<page>/revisions`, `handlers/RevisionsHandler.php`) restores an arbitrary old page revision — overwriting the current page body — on a **GET** reque...
🚨 CVE-2026-104452
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on GET requests without validating a CSRF token. Attackers can lure a logged-in page owner or administrator into a top-level GET navigation with do=del, erase, or emptytrash, deleting or permanently purging the page's attachments.
🎖@cveNotify
GitHub
CSRF: page attachment deletion/purge via GET in filemanager handler
## Summary
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
The YesWiki file-manager handler (`<page>/filemanager`, `tools/attach/handlers/page/filemanager.php`) deletes/erases/purges a page's attachments on a **GET** request with **no...
🚨 CVE-2026-104453
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the admintag action that allows attackers to delete tag associations by luring administrators to crafted GET links. Attackers can supply a wide id range in the delete_tag parameter via top-level navigation, carrying the SameSite=Lax admin cookie, to bulk-delete tag triples.
🎖@cveNotify
GitHub
CSRF: bulk tag-triple deletion via GET in admintag action
## Summary
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
The YesWiki tag-admin action (`{{admintag}}`, `tools/tags/actions/admintag.php`) performs an unconditional `DELETE` of tag-association triples on a **GET** request with **no CSRF token**...
🚨 CVE-2026-104454
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
🎖@cveNotify
GitHub
Unauthenticated CPU-exhaustion DoS via O(n^2) regex in core wiki formatter (edit-preview)
## Summary
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
An unauthenticated attacker can cause CPU-exhaustion denial of service against a default YesWiki installation by submitting a small crafted request body to the page-edit **preview** endp...
🚨 CVE-2026-104455
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS action. Attackers can request the xml method of a page hosting the action to retrieve 500-character body excerpts of every latest page, including read-restricted drafts and notes.
🎖@cveNotify
GitHub
Unauthenticated read-ACL bypass leaks page body excerpts via recentchangesrssplus RSS
## Summary
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
The `recentchangesrssplus` RSS action (`tools/rss/actions/recentchangesrssplus.php`) emits a 500-character excerpt of every page body into a public RSS feed with **no per-page read-ACL c...
🚨 CVE-2026-104456
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is concatenated unescaped into a read-ACL LIKE clause. Attackers can self-register an account name containing a double-quote payload, then load non-admin ACL-filtered listings to read database contents and bypass read ACLs.
🎖@cveNotify
GitHub
Second-order SQL injection in AclService::updateRequestWithACL via unescaped username in read-ACL LIKE clause
## Summary
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
A self-registered, low-privilege user can achieve second-order (stored) SQL injection in YesWiki's ACL read-filter builder. The user chooses an account name containing a double-quote...
🚨 CVE-2026-104457
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filtertags action, which wraps unescaped filterN attribute tokens in quotes and concatenates them into a raw tags.value IN (...) clause. Unauthenticated attackers on default installs can save filtertags markup in a page with a trailing-backslash token that breaks quote parity under MySQL backslash escaping. This lets them inject a five-column UNION subquery to read arbitrary table data such as password hashes.
🎖@cveNotify
GitHub
SQL injection in filtertags action via unescaped filterN parameter (backslash-escape breakout)
## Summary
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
The Bazar `filtertags` action concatenates unescaped `filterN` attributes into a raw SQL `tags.value IN (...)` clause. On MySQL with the default `sql_mode` (backslash-escapes enabled), a...
🚨 CVE-2026-104458
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
🎖@cveNotify
GitHub
SSRF guard bypass via IPv6 6to4 / NAT64 / IPv4-compatible transition wrappers of internal IPs (incomplete fix of the Signature.keyId…
## Summary
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
The `validateKeyIdUrl()` SSRF guard added to `HttpSignatureService::verifySignature()` blocks raw internal IPs and IPv4-mapped IPv6 (`::ffff:a.b.c.d`), but does not reject three other I...
🚨 CVE-2026-104459
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.
🎖@cveNotify
GitHub
SSRF via ActivityPub WebFinger handle resolution (actor_handle) - internal HTTPS reachability
## Summary
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
The ActivityPub WebFinger resolver builds a `.well-known/webfinger` URL from an attacker-supplied handle and fetches it server-side without ACL check or host/IP validation, yielding an S...
🚨 CVE-2026-104460
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table.
🎖@cveNotify
GitHub
Unauthenticated blind SQL injection in YesWiki `{{newtextsearch}}` via unescaped Bazar list option id
### Summary
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
YesWiki's `{{newtextsearch}}` search action contains an unauthenticated, blind SQL injection that lets any anonymous visitor read arbitrary attacker-chosen data from the database (...
🚨 CVE-2026-104461
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit entries via POST /api/entries/{formId} with SVG files containing script that executes in the wiki origin when the file is opened, enabling administrator session or account compromise.
🎖@cveNotify
GitHub
Stored XSS via unsanitized SVG upload in Bazar FileField (sanitization bypass)
## Summary
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
Bazar's `FileField` accepts file uploads on entry create/update and validates only the **extension** against the `authorized-extensions` allowlist — which **includes `svg`**. Un...
🚨 CVE-2026-104462
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data.
🎖@cveNotify
GitHub
SQL injection in nuagetag action via unescaped tags parameter (backslash-escape breakout)
## Summary
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...
The Bazar `nuagetag` action concatenates the unescaped `tags` attribute into a raw SQL `... value IN (...)` clause. On MySQL running with the default `sql_mode` (backslash-escapes enable...