CVE-2026-52774: YesWiki Bazar Widget XSS Vulnerability

CVE-2026-52774 Overview

CVE-2026-52774 is a reflected Cross-Site Scripting (XSS) vulnerability in YesWiki, a PHP-based wiki system. Versions prior to 4.6.6 contain a flaw in the Bazar widget handler that reflects the id GET parameter into HTML attributes using only strip_tags(). Because strip_tags() does not escape double quotes, an attacker can break out of the attribute value and inject event handlers such as onmouseover to execute arbitrary JavaScript in the victim's browser. The issue requires no authentication, no page ownership, and not even a valid page tag. The Bazar extension must be enabled and the request must include an id parameter. Maintainers patched the vulnerability in YesWiki 4.6.6.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser of any user who visits a crafted YesWiki widget URL, enabling session theft, credential harvesting, and actions on behalf of the victim.

Affected Products

YesWiki versions prior to 4.6.6
Deployments with the Bazar extension enabled
Any YesWiki instance exposing the /HomePage/widget route

Discovery Timeline

2026-09-05 - CVE-2026-52774 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52774

Vulnerability Analysis

The vulnerability resides in the Bazar widget handler at tools/bazar/handlers/__WidgetHandler.php and its associated template tools/bazar/presentation/templates/widget.tpl.html. The handler accepts the id GET parameter and applies strip_tags() before injecting the value into an HTML attribute (data-formid). While strip_tags() removes HTML tags, it leaves quote characters intact. An attacker can therefore terminate the attribute value with a double quote, append event handlers, and execute arbitrary JavaScript in the browser context of the visitor.

During validation, the vulnerable route returned reflected HTML for both /HomePage/widget?id=... and /NoSuchPage/widget?id=.... This confirms that the vulnerable code path does not require a valid page tag, edit rights, or authentication. The flaw is categorized under [CWE-80] (Improper Neutralization of Script-Related HTML Tags in a Web Page).

Root Cause

The root cause is reliance on strip_tags() as the sole sanitization function for user input embedded in HTML attributes. strip_tags() is designed to remove tags, not to encode characters that terminate attribute contexts. Because double quotes were never encoded, the id parameter value could escape the data-formid="..." attribute and introduce new attributes, including JavaScript event handlers.

Attack Vector

Exploitation requires a victim to click or otherwise load a crafted URL pointing at any widget endpoint of a vulnerable YesWiki instance. The Bazar extension must be enabled on the target. No authentication, page ownership, or valid page identifier is required. Successful exploitation runs attacker-controlled JavaScript in the victim's session, enabling session cookie theft, CSRF chaining, phishing overlays, and privileged actions if the victim is an administrator.

php

// Vulnerable code prior to 4.6.6 (tools/bazar/handlers/__WidgetHandler.php)
$urlParams = 'id=' . strip_tags($_GET['id']) . (isset($_GET['query']) ? '&query=' . strip_tags($_GET['query']) : '') . (!empty($q) ? '&q=' . $q : '');

// Patched code in 4.6.6
$urlParams = 'id=' . urlencode(strip_tags($_GET['id'])) . (isset($_GET['query']) ? '&query=' . urlencode(strip_tags($_GET['query'])) : '') . (!empty($q) ? '&q=' . urlencode($q) : '');

Source: GitHub Commit 1aa2710

text

<!-- Vulnerable template (widget.tpl.html) -->
<div id="widgetapp" v-cloak
  data-formid="<?php echo strip_tags($_GET['id']); ?>"

<!-- Patched template -->
<div id="widgetapp" v-cloak
  data-formid="<?php echo htmlspecialchars(strip_tags($_GET['id']), ENT_QUOTES, 'UTF-8'); ?>"

Source: GitHub Commit 1aa2710

Detection Methods for CVE-2026-52774

Indicators of Compromise

HTTP requests to /*/widget?id=... containing double quote characters, <, >, or event handler names such as onmouseover, onfocus, or onerror
Access log entries targeting non-existent page tags followed by /widget (for example, /NoSuchPage/widget?id=...)
Referrer headers linking to suspicious external hosts distributing crafted YesWiki URLs
Unexpected outbound requests from browsers immediately after loading a widget URL, suggesting cookie exfiltration

Detection Strategies

Inspect web server access logs for id parameter values containing URL-encoded quotes (%22), angle brackets (%3C, %3E), or JavaScript keywords
Deploy Web Application Firewall (WAF) rules to flag reflected XSS payloads against YesWiki widget routes
Compare installed YesWiki version against the fixed 4.6.6 release using file hash or version banner checks

Monitoring Recommendations

Forward YesWiki access logs to a centralized logging platform and alert on anomalous query strings targeting the Bazar widget handler
Monitor authenticated administrator sessions for unexpected DOM activity or session token reuse from new IP addresses
Track outbound HTTP requests from user browsers loading YesWiki pages for signs of stolen cookies being posted to attacker infrastructure

How to Mitigate CVE-2026-52774

Immediate Actions Required

Upgrade all YesWiki instances to version 4.6.6 or later as published in the YesWiki 4.6.6 release
Review the GitHub Security Advisory GHSA-r5xw-gcgw-hwp5 for full remediation guidance
Rotate administrator session cookies and force re-authentication after patching
Audit web server logs for prior exploitation attempts against widget routes

Patch Information

The fix is delivered in YesWiki 4.6.6. The patch wraps reflected values with urlencode() in the handler and applies htmlspecialchars(..., ENT_QUOTES, 'UTF-8') in the template so that double quotes, single quotes, and angle brackets are encoded before insertion into HTML attributes. See the commit 1aa2710 for the exact changes.

Workarounds

Disable the Bazar extension until the upgrade to 4.6.6 can be completed
Deploy WAF rules that reject requests to /*/widget containing quote characters or HTML event handler substrings in the id parameter
Restrict access to widget routes behind authentication or network-level ACLs where the widget is not publicly required

bash

# Example WAF rule (ModSecurity) blocking XSS payloads on YesWiki widget routes
SecRule REQUEST_URI "@rx /widget\?" \
  "id:1052774,phase:2,deny,status:403,msg:'YesWiki CVE-2026-52774 XSS attempt',\
  chain"
  SecRule ARGS:id "@rx (\"|<|>|on[a-z]+\s*=)" "t:lowercase,t:urlDecodeUni"