CVE-2025-46346: YesWiki Stored XSS Vulnerability

CVE-2025-46346 Overview

CVE-2025-46346 is a stored cross-site scripting (XSS) vulnerability in YesWiki, an open-source wiki system written in PHP. The flaw exists in the application's comments feature, where user-submitted input is not properly sanitized or encoded before rendering. While the application blocks <script> tags, it fails to filter payloads obfuscated with JavaScript block comments such as /* JavaScriptPayload */. Any user viewing an affected comment executes the attacker's injected JavaScript in their browser session. The vulnerability affects all YesWiki versions prior to 4.5.4 and is classified under [CWE-79].

Critical Impact
Authenticated or anonymous attackers can inject persistent JavaScript through comments, hijacking sessions and performing actions in the context of any user, including administrators, who views the affected wiki page.

Affected Products

YesWiki versions prior to 4.5.4
YesWiki comments feature (stored XSS sink)
Deployments exposing wiki comments to authenticated or public users

Discovery Timeline

2025-04-29 - CVE-2025-46346 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46346

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in YesWiki's comment submission and rendering pipeline. Attackers submit a comment containing a JavaScript payload obfuscated with block comment syntax. The server persists the payload without adequate output encoding. When another user renders the page, the browser parses and executes the injected script.

Stored XSS in a wiki platform is particularly impactful because comments are viewed by many users, including administrators. A successful attack can lead to session hijacking, credential theft through fake login prompts, privilege escalation via administrative action forgery, and further defacement of the wiki content.

Root Cause

The root cause is incomplete input sanitization in the comments feature. YesWiki filters common XSS vectors such as <script> tags but does not neutralize payloads wrapped in JavaScript block comment delimiters like /* payload */. Attackers exploit this parser gap to smuggle executable JavaScript past the sanitizer. The application also fails to apply strict output encoding at render time, which would have neutralized the payload regardless of storage state.

Attack Vector

The attack requires network access to a YesWiki instance and the ability to post a comment. User interaction is required only in that a victim must view the page containing the malicious comment. No authentication is required if the target instance permits anonymous commenting. The attacker crafts a comment containing an obfuscated payload, submits it through the standard comment form, and waits for other users, ideally administrators, to load the page.

php

// Security patch excerpt from includes/YesWikiInit.php
                new AnnotationReader()
            )
        );
-
        // Core controllers
        $routes->addCollection($loader->load('includes/controllers'));

php

// Security patch excerpt from tools/templates/controllers/ApiController.php
class ApiController extends YesWikiController
{
    /**
-    * @Route("/api/templates/custom-presets/{presetFilename}", methods={"DELETE"},options={"acl":{"public","@admins"}})
+    * @Route("/api/templates/custom-presets/{presetFilename}", methods={"DELETE"},options={"acl":{"@admins"}})
    */
    public function deleteCustomCSSPreset($presetFilename)
    {

Source: YesWiki commit 0d4efc8. These excerpts show hardening changes included in the same 4.5.4 security release that addresses CVE-2025-46346. Refer to the GHSA-59x8-cvxh-3mm4 advisory for the full comment sanitizer changes.

Detection Methods for CVE-2025-46346

Indicators of Compromise

Comments containing JavaScript block comment delimiters /* */ wrapping keywords such as alert, fetch, document.cookie, or eval
Outbound HTTP requests from user browsers to attacker-controlled domains immediately after loading wiki pages with comments
Newly created or elevated YesWiki administrator accounts without a corresponding admin action in server logs
Unusual POST requests to comment endpoints from a single IP submitting encoded or obfuscated payloads

Detection Strategies

Query the YesWiki database for comment records containing /*, */, on[a-z]+=, or javascript: substrings
Deploy a web application firewall rule that inspects comment submissions for JavaScript block comment obfuscation patterns
Enable Content Security Policy (CSP) reporting to capture violations from injected inline scripts
Correlate wiki page views with anomalous client-side network activity in browser telemetry

Monitoring Recommendations

Log all POST requests to comment endpoints with full request bodies for forensic review
Monitor for repeated comment submissions from the same IP or session that fail sanitization checks
Alert on YesWiki version banners still reporting versions prior to 4.5.4 on internet-exposed hosts

How to Mitigate CVE-2025-46346

Immediate Actions Required

Upgrade all YesWiki installations to version 4.5.4 or later without delay
Audit existing comments across all wiki pages and remove entries containing suspicious JavaScript payloads
Rotate administrator credentials and invalidate active sessions if the instance was internet-exposed before patching
Restrict comment posting to authenticated users while remediation is in progress

Patch Information

The issue is fixed in YesWiki 4.5.4. Review the YesWiki security advisory GHSA-59x8-cvxh-3mm4 and the upstream commit 0d4efc8 for full details on the sanitizer changes and related access control hardening shipped in the same release.

Workarounds

Disable the comments feature on all wiki pages until the upgrade to 4.5.4 is complete
Deploy a strict Content Security Policy that blocks inline script execution to reduce XSS impact
Configure a WAF signature that rejects comment payloads containing /* and */ in combination with JavaScript identifiers

bash

# Example: verify installed YesWiki version and upgrade via git
cd /var/www/yeswiki
git fetch --tags
git checkout 4.5.4
# Clear application cache after upgrade
rm -rf cache/*