Vulnerability · Published Sep 4, 2026 · Assigned by GitHub_M

CVE-2026-52762YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

High 7.1

In plain English

A high-severity security flaw in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	yeswiki/yeswiki	4.6.6	GHSA-65p8-9433-jpcp

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	< 4.6.6

Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp x_refsource_CONFIRM
https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b x_refsource_MISC
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 x_refsource_MISC