CVE-2026-52773: YesWiki PHP Wiki System XSS Vulnerability

CVE-2026-52773 Overview

CVE-2026-52773 is a reflected Cross-Site Scripting (XSS) vulnerability in YesWiki, a PHP-based wiki system. The flaw affects versions 4.1.0 through 4.6.5 and resides in handlers/page/show.php. The archived-revision view reflects the time GET parameter into a hidden HTML input without proper escaping. Attackers can append HTML or JavaScript to a valid archived revision timestamp because MySQL coerces malformed DATETIME strings. This allows arbitrary JavaScript execution in a victim's browser when they load the crafted archived revision URL. The issue is tracked as [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Critical Impact
On default doryphore 4.6.5 installations, public pages such as PagePrincipale are editable anonymously, enabling unauthenticated attackers to execute JavaScript in visitor browsers.

Affected Products

YesWiki versions 4.1.0 through 4.6.5
YesWiki doryphore 4.6.5 default installations (including anonymous scenarios)
Deployments where users have combined read and write access to target pages

Discovery Timeline

2026-09-05 - CVE-2026-52773 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52773

Vulnerability Analysis

The vulnerability exists in the archived-revision editing form rendered by handlers/page/show.php. YesWiki reads the time GET parameter and embeds it directly into a hidden HTML input's value attribute. No output encoding is applied. An attacker crafts a URL containing a valid archived revision timestamp appended with HTML-breaking characters and script payloads. MySQL silently coerces the malformed DATETIME string, so the backend still loads the requested archived revision. The unescaped attacker-controlled data reaches the rendered form and breaks out of the attribute context.

The form is only rendered when the viewing user can both read and edit the target page. In restricted deployments this limits impact to users with write access. However, the default doryphore 4.6.5 install ships with anonymously editable public pages, expanding exposure to unauthenticated visitors during validation flows.

Root Cause

The root cause is missing output encoding of user-controlled data before insertion into an HTML attribute. The $time variable derived from $_GET['time'] was echoed directly into the value attribute of a hidden <input> element without calling htmlspecialchars() or an equivalent sanitizer.

Attack Vector

Exploitation requires user interaction. An attacker delivers a crafted URL to a target user with edit permissions on the affected page. When the victim loads the archived-revision view, the injected payload executes in their browser session within the origin of the YesWiki instance.

php

// Vulnerable code (before patch) vs. fixed code in handlers/page/show.php
<?php
$time = isset($_GET['time']) ? $_GET['time'] : '';
echo $this->FormOpen(testUrlInIframe() ? 'editiframe' : 'edit', '', 'get'); ?>
- <input type="hidden" name="time" value="<?php echo $time; ?>" />
+ <input type="hidden" name="time" value="<?php echo htmlspecialchars($time, ENT_QUOTES, YW_CHARSET); ?>" />
<input class="btn btn-primary" type="submit" value="<?php echo _t('EDIT_ARCHIVED_REVISION'); ?>" />
<?php echo $this->FormClose(); ?>

Source: GitHub Commit 35ad9c2. The patch applies htmlspecialchars() with ENT_QUOTES and the YesWiki charset to neutralize both single and double quotes.

Detection Methods for CVE-2026-52773

Indicators of Compromise

HTTP requests to YesWiki page handlers containing a time GET parameter with encoded characters such as %22, %3E, or <script.
Web server access logs showing anomalously long or malformed values in the time query parameter on archived revision URLs.
Referer headers pointing to external phishing domains before requests to the wiki's archived-revision endpoint.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the time parameter for attribute-breaking characters and script tag fragments.
Review YesWiki access logs for GET requests to page show handlers where the time value fails DATETIME format validation.
Enable Content Security Policy (CSP) reporting to surface script-source violations originating from the wiki application.

Monitoring Recommendations

Monitor for unexpected outbound requests from browser sessions authenticated to the YesWiki instance.
Alert on anonymous edits to public pages such as PagePrincipale in doryphore installations.
Correlate authentication events with subsequent page-edit activity to identify hijacked sessions post-XSS.

How to Mitigate CVE-2026-52773

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later, which contains the fix from commit 35ad9c2.
Audit doryphore deployments and disable anonymous editing on public pages until patching is complete.
Invalidate active sessions after upgrade to eliminate any tokens potentially captured through prior exploitation.

Patch Information

The fix is published in YesWiki Release v4.6.6 and detailed in GitHub Security Advisory GHSA-35f3-pg38-486f. The patch wraps the $time value with htmlspecialchars($time, ENT_QUOTES, YW_CHARSET) before rendering the hidden input.

Workarounds

Restrict edit permissions on the wiki so that only authenticated, trusted users can trigger the archived-revision form.
Deploy a strict Content Security Policy that disallows inline scripts and unsafe event handlers.
Apply WAF rules to strip or reject time parameter values that do not match the expected DATETIME pattern.

bash

# Example WAF rule (ModSecurity) to block malformed time parameters on YesWiki
SecRule ARGS:time "!@rx ^[0-9]{4}-[0-9]{2}-[0-9]{2}[ T][0-9]{2}:[0-9]{2}:[0-9]{2}$" \
  "id:1052773,phase:2,deny,status:400,msg:'CVE-2026-52773 YesWiki XSS attempt in time parameter'"