CVE-2026-52762

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6

Description YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) in the semantic template feature. SSTI occurs when an application embeds user-supplied input into a server-side template without proper validation, allowing the execution of arbitrary code. This issue can be escalated to Remote Code Execution (RCE), where an attacker can execute arbitrary operating-system commands on the host server.

An authenticated administrator can inject arbitrary Twig expressions into the bn sem template (Semantic template (Twig)) or bn sem reverse template fields. This content is stored in the form configuration and subsequently executed server-side via the TemplateEngine::renderFromStringNoEscape() function when public semantic endpoints are requested, such as the endpoint /api/forms/{id}/entries/json-ld.

Recommendations Update YesWiki to version 4.6.6. As a temporary workaround, restrict access to the bn sem template and bn sem reverse template fields to prevent the injection of malicious Twig expressions.