CVE-2026-52772
Received Received - Intake

Stored XSS in YesWiki Prior to Version 4.6.6

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52772

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.6 has a stored cross-site scripting (XSS) vulnerability in Bazar form-field templates. The issue occurs because templates apply raw HTML rendering to field labels and hints in attribute and label-body contexts, allowing malicious scripts to be stored and executed when forms are rendered.

Detection Guidance

To detect this vulnerability, check if your YesWiki instance is running a version prior to 4.6.6. Use commands like 'grep' to inspect version details in files or database entries. For example: grep -r 'YesWiki' /path/to/yeswiki/installation or check the version in the admin panel.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into YesWiki forms. When users view or interact with these forms, the scripts may execute in their browsers, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information integrity. Both standards require protecting against such attacks to ensure data security and compliance.

Mitigation Strategies

Immediately update YesWiki to version 4.6.6 or later. This patched version resolves the stored XSS issue in Bazar form-field templates. Backup your data before updating to avoid data loss.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart