CVE-2026-52762: YesWiki Bazar SSTI to RCE Vulnerability

CVE-2026-52762 Overview

CVE-2026-52762 is a stored Server-Side Template Injection (SSTI) vulnerability in YesWiki, a PHP-based wiki system. The flaw resides in the Bazar extension's semantic template feature. An authenticated administrator can inject arbitrary Twig expressions into the bn_sem_template field. The stored payload executes server-side when public semantic endpoints are requested, enabling escalation to Remote Code Execution (RCE). The issue affects YesWiki versions prior to 4.6.6 and is tracked as [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Stored Twig template injection in the Bazar bn_sem_template field enables authenticated administrators to achieve server-side code execution against the YesWiki host through publicly reachable semantic endpoints.

Affected Products

YesWiki (all versions prior to 4.6.6)
YesWiki Bazar extension — semantic template feature (bn_sem_template)
Public semantic endpoints that render stored Twig templates

Discovery Timeline

2026-09-05 - CVE-2026-52762 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52762

Vulnerability Analysis

YesWiki's Bazar module allows administrators to define semantic templates in Twig syntax through the bn_sem_template form field. The vulnerable code path in tools/bazar/services/SemanticTransformer.php passes the stored template directly to renderFromStringNoEscape(), which performs unsandboxed Twig rendering. Because Twig expressions can invoke PHP functions, filters, and object methods when executed in a non-sandboxed context, an attacker can craft payloads that reach system-level primitives. The rendered output is served through public semantic endpoints, meaning unauthenticated visitors trigger execution of the stored payload on each request.

Root Cause

The root cause is the use of an unsandboxed template rendering call for administrator-supplied content. renderFromStringNoEscape() does not restrict available Twig tags, functions, or object access. Storing untrusted template source and later evaluating it server-side violates the template engine's trust boundary described in [CWE-1336].

Attack Vector

Exploitation requires authenticated administrator access to a YesWiki instance running a vulnerable Bazar form. The attacker edits the semantic template field, injecting Twig expressions that resolve to command execution or file access. Subsequent HTTP requests to the associated public semantic endpoint trigger the payload. Because execution occurs on the server, the attacker gains code execution in the context of the PHP process.

php

// Patch: tools/bazar/services/SemanticTransformer.php
// Before (vulnerable): unsandboxed rendering of stored admin input
- $json = $this->templateEngine->renderFromStringNoEscape($form['bn_sem_template'], $data);
// After (fixed): sandboxed rendering restricts available Twig primitives
+ $json = $this->templateEngine->renderSandboxedFromStringNoEscape($form['bn_sem_template'], $data);

Source: YesWiki commit 89462f1

Detection Methods for CVE-2026-52762

Indicators of Compromise

Unexpected Twig syntax (for example, {{ ... }}, {% ... %}, or references to _self, getEnvironment, or PHP callables) stored in Bazar form fields, particularly bn_sem_template.
PHP process spawning shell utilities such as sh, bash, curl, or wget from the web server user during semantic endpoint requests.
Outbound network connections initiated by the YesWiki host immediately after requests to public Bazar semantic URLs.

Detection Strategies

Audit the Bazar database tables and form definitions for bn_sem_template values containing Twig control structures or function calls.
Correlate web access logs for requests to semantic endpoints with subsequent process creation events on the web server.
Compare the running YesWiki version against 4.6.6 and flag any host serving vulnerable versions.

Monitoring Recommendations

Enable file integrity monitoring on YesWiki tools/bazar/ and includes/services/TemplateEngine.php to detect tampering.
Log administrator authentication events and changes to Bazar form definitions for post-incident review.
Alert on PHP-FPM or Apache workers executing command interpreters or writing to writable web directories.

How to Mitigate CVE-2026-52762

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later, which replaces the vulnerable rendering call with a sandboxed equivalent.
Review all existing Bazar forms and remove Twig expressions from bn_sem_template fields introduced by unverified administrators.
Rotate administrator credentials and session tokens on any instance suspected of exposure prior to patching.

Patch Information

The fix is available in YesWiki 4.6.6. The patch, published in commit 89462f1, swaps renderFromStringNoEscape() for renderSandboxedFromStringNoEscape() in SemanticTransformer.php, applying Twig's sandbox extension to restrict tags, functions, and method calls. Full details are in GitHub Security Advisory GHSA-65p8-9433-jpcp.

Workarounds

Restrict administrator role assignment to trusted users only until the upgrade is applied.
Disable or block public access to Bazar semantic endpoints at the web server or reverse proxy layer.
Enforce web application firewall rules that block Twig metacharacters in Bazar form submissions where feasible.

bash

# Example nginx block to restrict public semantic endpoint access pre-patch
location ~ /\?.*action=(semantic|json) {
    allow 10.0.0.0/8;
    deny all;
}