CVE-2026-52772: YesWiki Bazar Form Stored XSS Vulnerability

CVE-2026-52772 Overview

YesWiki is an open-source wiki system written in PHP. CVE-2026-52772 is a stored cross-site scripting (XSS) vulnerability [CWE-79] affecting the Bazar module in versions prior to 4.6.6. Bazar form-field templates apply the Twig |raw('html') filter to field.label and field.hint values in attribute and label-body contexts, bypassing HTML escaping. An authenticated user with permission to edit form definitions can inject malicious HTML or JavaScript that executes when other users render the affected forms. The maintainers patched the issue in YesWiki 4.6.6.

Critical Impact
Stored XSS in Bazar form renders enables session hijacking, credential theft, and unauthorized actions in the context of any user viewing an affected form.

Affected Products

YesWiki versions prior to 4.6.6
YesWiki Bazar module (tools/bazar/fields/BazarField.php)
YesWiki Bookmarklet field component (tools/bazar/fields/BookmarkletField.php)

Discovery Timeline

2026-09-05 - CVE-2026-52772 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-52772

Vulnerability Analysis

The flaw resides in the Bazar form rendering pipeline. Twig templates responsible for drawing form fields apply the |raw('html') filter to field.label and field.hint values. The raw filter marks a string as safe and disables Twig's automatic HTML escaping. Because form field metadata is user-controlled during form creation or edit, an attacker with form-editing privileges can persist HTML markup in these fields. When any user subsequently views a page that renders the form, the injected markup executes in their browser session. The attack succeeds in both HTML attribute contexts and label-body contexts, giving the attacker multiple injection primitives.

Root Cause

The root cause is improper output encoding in Twig templates that render Bazar form field metadata. Trusting stored label and hint values as safe HTML violates the principle of context-aware output encoding for user-supplied data.

Attack Vector

Exploitation requires an authenticated account with privileges to create or edit Bazar forms. The attacker submits crafted HTML or JavaScript in a form field's label or hint attribute. The payload is stored in the wiki database and executes when subsequent users load the form. Because the payload runs in the victim's browser under the YesWiki origin, it can access session cookies, perform actions on behalf of administrators, and pivot to further compromise.

php

// Patch excerpt: tools/bazar/fields/BazarField.php
 use Psr\Container\ContainerInterface;
 use YesWiki\Core\Service\AclService;
+use YesWiki\Core\Service\HtmlPurifierService;
 use YesWiki\Core\Service\TemplateEngine;
 use YesWiki\Wiki;

// Patch excerpt: tools/bazar/fields/BookmarkletField.php
 namespace YesWiki\Bazar\Field;

 use Psr\Container\ContainerInterface;
+use YesWiki\Core\Service\HtmlPurifierService;

Source: YesWiki commit 5d1a4d07. The patch introduces the HtmlPurifierService into the affected field classes so that label and hint output is sanitized before rendering.

Detection Methods for CVE-2026-52772

Indicators of Compromise

Bazar form definitions containing <script>, onerror=, onload=, or javascript: tokens in label or hint fields.
Unexpected outbound requests from browsers viewing wiki pages that reference Bazar forms.
New or modified form definitions authored by low-trust accounts followed by session anomalies for higher-privileged users.

Detection Strategies

Query the wiki database or exported form definitions for HTML tags and event-handler attributes stored inside Bazar field.label and field.hint values.
Inspect HTTP response bodies from YesWiki form pages for unescaped <, >, or on*= sequences originating from form metadata.
Correlate authenticated form-edit events with subsequent client-side script execution or credential-theft indicators.

Monitoring Recommendations

Enable web server access logging for POST requests targeting Bazar form editing endpoints and review by account and source IP.
Deploy a Content Security Policy (CSP) that reports script-source violations to a monitoring endpoint.
Audit YesWiki account privileges and log role changes that grant form-authoring permissions.

How to Mitigate CVE-2026-52772

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later as published in the YesWiki v4.6.6 release.
Review existing Bazar form definitions and remove or sanitize any HTML content stored in label and hint fields.
Rotate session tokens and administrator credentials if suspicious form edits are found.

Patch Information

The fix landed in YesWiki 4.6.6 via commit 5d1a4d07. The patch wires HtmlPurifierService into BazarField.php and BookmarkletField.php so that field metadata is purified before being emitted by Twig templates. Full technical detail is available in the GitHub Security Advisory GHSA-xc7j-3g8q-9vh4.

Workarounds

Restrict form-editing permissions in Bazar to trusted administrators only until the upgrade is applied.
Enforce a strict CSP that disallows inline scripts and untrusted script sources to limit XSS payload execution.
Temporarily disable public access to Bazar forms if the wiki cannot be upgraded immediately.

bash

# Upgrade YesWiki to the patched release
cd /var/www/yeswiki
git fetch --tags
git checkout v4.6.6
# Or download the release archive:
wget https://github.com/YesWiki/yeswiki/archive/refs/tags/v4.6.6.tar.gz
tar -xzf v4.6.6.tar.gz