CVE-2026-52762
Received Received - Intake

Stored SSTI to RCE in YesWiki Bazar

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52762

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki is a PHP-based wiki system. Prior to version 4.6.6, it contains a stored Server-Side Template Injection (SSTI) vulnerability in the Bazar component. An authenticated administrator can inject arbitrary Twig expressions into the Semantic template field, which are then executed server-side when semantic endpoints are accessed.

Detection Guidance

Check YesWiki version with: grep -r 'YesWiki' /path/to/yeswiki/ | grep 'version'. If version is below 4.6.6, it is vulnerable. Look for suspicious Semantic template (Twig) fields in YesWiki admin panel containing Twig expressions like {{7*7}} or similar.

Impact Analysis

An attacker with admin access could exploit this to execute arbitrary code on the server, potentially leading to full system compromise. This could allow data theft, unauthorized modifications, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may risk protected health information exposure. Compliance failures could result in legal penalties or fines.

Mitigation Strategies

Upgrade YesWiki to version 4.6.6 or later immediately. Remove or review any custom Semantic templates (Twig fields) added by administrators for malicious content. Restrict admin access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart