What’s Vulnerable › Vulnerabilities

CVE-2026-52762: YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-09-08
• Weakness: CWE-1336

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

Affected products

• yeswiki: before 4.6.6

References

• https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp

Get alerted when CVE-2026-52762 or the next vulnerability affects your stack