CVE-2026-52772 in YesWiki
Summary
by MITRE • 09/05/2026
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
YesWiki is a collaborative wiki platform built on PHP that allows users to create and manage content through various modules, including the Bazar module which facilitates event management and form creation. The vulnerability identified affects versions prior to 4.6.6 within this system's template rendering engine. Specifically, the flaw resides in how field labels and hints are processed when rendered as part of a form structure. In these earlier iterations, the application applies the raw HTML filter to the label and hint attributes associated with Bazar form fields without adequate sanitization or encoding checks for user-supplied input that might be embedded within those templates.
This technical flaw constitutes an Stored Cross-Site Scripting vulnerability because malicious script payloads can be persisted in the database through the configuration of form field labels or hints by authorized users who have permission to edit these forms. When another user subsequently views or interacts with a page containing such a compromised form, the browser executes the injected JavaScript code within the context of the YesWiki domain. This execution occurs because the application treats the content as raw HTML rather than escaping it into safe text entities before rendering it in the label-body and attribute contexts where browsers are particularly susceptible to script injection via event handlers or other executable attributes.
The operational impact of this vulnerability is significant for environments relying on multi-user collaboration, as it allows an attacker with editing privileges to compromise the sessions of any user who accesses the affected form pages. This can lead to session hijacking, credential theft through keylogging scripts, defacement of the wiki interface, or further exploitation if combined with other vulnerabilities such as CSRF tokens being bypassed due to context confusion. The persistence aspect means that the attack does not require a single-click interaction from an external source but rather relies on the victim visiting any page where the malicious form is displayed, increasing the likelihood of successful compromise in active collaborative spaces.
From a classification perspective, this issue aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and specifically falls under Stored XSS patterns often categorized within ATT&CK technique T1059 Command and Scripting Interpreter when the payload is designed to execute system commands or exfiltrate data. The root cause lies in insufficient input validation and output encoding practices during the template rendering phase, where developer assumptions about trusted content sources were not enforced through strict sanitization protocols before HTML generation.
Mitigation strategies primarily involve upgrading the YesWiki installation to version 4.6.6 or later, which includes patches that enforce proper escaping of user-supplied data in label and hint contexts regardless of their source. For organizations unable to immediately patch due to dependency constraints, implementing a Web Application Firewall rule set capable of detecting and blocking XSS payloads within form submission fields can provide temporary protection. Additionally, enforcing strict Content Security Policy headers with nonces or hashes for script execution can mitigate the impact by preventing unauthorized scripts from running even if they are injected into the DOM through this vulnerability vector. Regular security audits focusing on template engine configurations and input handling in collaborative platforms are recommended to prevent similar issues arising from other modules or future updates.