CVE-2026-104454 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in YesWiki versions prior to 4.6.7 represents a significant algorithmic complexity denial-of-service flaw located within the wakka.php formatter component. This issue stems from an inefficient regular expression pattern used for processing markdown links, which exhibits quadratic time complexity relative to the length of the input string. Specifically, the regex engine employed by PHP encounters catastrophic backtracking when presented with specific sequences of bracket characters. While standard markdown parsing is generally efficient, this particular implementation fails to optimize its matching logic, causing computational resources to scale poorly as the size of the malicious payload increases slightly beyond a certain threshold.
Unauthenticated attackers can exploit this flaw by submitting a carefully crafted body containing nested or repetitive bracket structures to the page-edit preview endpoint. Because YesWiki allows users to preview edits before saving them, an attacker does not need valid credentials to trigger the vulnerability. By sending a small but specifically constructed string of brackets, such as deeply nested parentheses or repeated opening and closing symbols that confuse the regex engine's state machine, the application forces the underlying PHP interpreter into an infinite loop or near-infinite computation cycle during the parsing phase. This behavior is not immediately apparent through simple length checks because even relatively short strings can trigger exponential processing times due to the nature of backtracking algorithms when faced with ambiguous patterns.
The operational impact of this vulnerability is severe for infrastructure hosting YesWiki instances, particularly those utilizing PHP-FPM (FastCGI Process Manager). When a request triggers the inefficient regex execution, it consumes nearly all available CPU cycles within that specific worker process without completing or returning an error response in a timely manner. Since PHP-FPM workers are finite resources managed by a pool configuration, each pinned worker reduces the capacity of the server to handle legitimate traffic. An attacker can sustain this state by sending multiple concurrent requests, effectively saturating the entire PHP-FPM pool. This results in a complete denial of service for all users attempting to access or edit pages on the wiki, as no new workers are available to process valid requests until the pinned processes eventually time out or are manually restarted.
From a classification perspective, this vulnerability aligns with CWE-400, which covers uncontrolled resource consumption due to algorithmic complexity issues. It is also relevant to CWE-730, describing denial of service through inefficient regular expression matching. In terms of the MITRE ATT&CK framework, this attack vector falls under T1499: Endpoint Denial of Service, specifically leveraging application-layer exhaustion techniques rather than network-level flooding. The lack of authentication requirements makes it particularly dangerous as part of a broader campaign to disrupt availability without needing prior access credentials.
Mitigation strategies primarily involve upgrading the YesWiki installation to version 4.6.7 or later, where this regex pattern has been optimized to prevent catastrophic backtracking. For environments that cannot immediately patch due to dependency constraints, implementing rate limiting on the page-edit preview endpoint can help mitigate the impact by restricting the frequency of requests from a single source IP address. Additionally, configuring PHP-FPM with stricter timeout limits and worker restart thresholds may reduce the duration of the denial-of-service effect, although this is a compensatory measure rather than a fix for the underlying code flaw. Web Application Firewalls (WAFs) can also be configured to detect and block requests containing suspicious patterns of nested brackets that are characteristic of regex-based DoS attacks, providing an additional layer of defense while patching efforts proceed.