CVE-2026-52774 in YesWiki
Summary
by MITRE • 09/05/2026
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such as onmouseover, and execute arbitrary JavaScript in the victim's browser. This issue is reachable without authentication. During validation, the vulnerable widget route returned the injected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., which shows that no login, no page ownership, no edit rights, and not even a valid page tag were required. The only routing prerequisite observed was that the Bazar extension is enabled and the request includes an id parameter. This issue has been patched in version 4.6.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
YesWiki is a wiki system written in PHP that allows users to create, edit, and manage collaborative content through various widgets and extensions. One such component is the Bazar widget handler, which processes user-supplied input via GET parameters to generate dynamic HTML responses. In versions prior to 4.6.6, this handler exhibited a critical server-side weakness related to improper neutralization of special elements used in an HTML page, commonly classified under CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting. The vulnerability arises from the application's reliance on the PHP function strip_tags() for input sanitization when reflecting the id parameter into HTML attributes. While strip_tags() removes HTML tags and scripts, it does not escape special characters such as double quotes or single quotes that are used to delimit attribute values in HTML markup. This incomplete sanitization allows an attacker to break out of the intended attribute context by injecting a closing quote followed by malicious event handlers.
The technical flaw manifests when an unauthenticated user supplies a crafted id parameter containing JavaScript code wrapped within an event handler, such as onmouseover or onload. Because the application reflects this input directly into HTML attributes without properly escaping delimiters, the injected payload becomes part of the rendered page structure rather than being treated as plain text. For instance, if the vulnerable route returns content like <div data-id="USER_INPUT">, injecting a value like " onclick=alert(1) allows the attacker to close the attribute and append executable JavaScript code that triggers upon user interaction or page load. This mechanism enables Cross-Site Scripting (XSS), specifically stored or reflected depending on persistence, allowing arbitrary script execution within the victim's browser context. The impact includes session hijacking through cookie theft, credential harvesting via phishing forms injected into the DOM, defacement of wiki pages, and potentially redirecting users to malicious external sites for further exploitation campaigns.
The severity of this vulnerability is significantly amplified by its lack of authentication requirements. Analysis reveals that the vulnerable widget route responds with the injected HTML regardless of whether the user is logged in, owns any specific page, possesses edit rights, or even provides a valid existing page tag. The routing logic accepts requests for both /HomePage/widget?id=... and /NoSuchPage/widget?id=..., indicating that no existence check on the target page was performed before processing the widget parameters. This means the attack surface is broad and accessible to any anonymous visitor who can craft a URL pointing to this endpoint, provided only that the Bazar extension is enabled within the YesWiki installation. The absence of access controls transforms what might otherwise be a low-impact reflection issue into a high-risk vulnerability capable of affecting all users visiting maliciously crafted links or embedded images in public wiki pages.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, specifically sub-techniques involving JavaScript execution within web browsers. It also relates to T1189: Drive-by Compromise if the payload is designed to exploit browser vulnerabilities or deliver malware through malicious redirects. The exploitation chain typically involves social engineering tactics where an attacker lures a victim into clicking a link containing the crafted id parameter, often disguised as legitimate wiki content or embedded in emails and forums associated with the platform. Once executed, the JavaScript runs with the same privileges as other scripts on the page, potentially accessing sensitive data stored in local storage, cookies, or session variables if not properly scoped by SameSite attributes or HttpOnly flags.
Mitigation strategies focus primarily on upgrading to YesWiki version 4.6.6 or later, where this issue has been patched through improved input handling and output encoding practices. Until an upgrade is feasible, administrators should consider disabling the Bazar extension entirely if it is not actively required for their wiki operations, thereby removing the vulnerable code path from exposure. Additionally, implementing a Web Application Firewall (WAF) with rulesets tuned to detect common XSS payloads in GET parameters can provide a layer of defense against exploitation attempts. Security headers such as Content-Security-Policy should also be configured to restrict inline script execution and define trusted sources for external resources, reducing the impact if an injection succeeds. Developers reviewing similar PHP applications must ensure that all user-supplied data reflected into HTML attributes is properly encoded using functions like htmlspecialchars() with appropriate flags rather than relying solely on tag-stripping mechanisms which leave attribute delimiters vulnerable to context switching attacks.