PT-2026-57032 · Yeswiki+2 · Yeswiki+1

CVE-2026-52772

·

Published

2026-07-09

·

Updated

2026-09-05

CVSS v3.1

5.5

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6
Description Bazar form-field templates fail to properly sanitize input, leading to stored Cross-Site Scripting (XSS). The issue occurs because the |raw('html') or |raw filters are applied to field.label and field.hint variables within HTML attributes and label-body contexts, suppressing Twig's automatic escaping. This allows a user with the saisie formulaire permission (typically administrators) to inject malicious scripts into form definitions. These scripts then execute in the browser of any user viewing the form, including unauthenticated visitors.
Technical details include three main injection vectors:
  • Attribute breakout: In templates like range.twig and email.twig, the placeholder attribute uses field.label with |raw('html')|striptags, allowing an attacker to use double quotes to break out of the attribute and inject event handlers.
  • Tooltip injection: In layouts/input.twig, the title and alt attributes of an image use field.hint with |raw('html'), allowing full HTML injection.
  • Direct DOM injection: In layouts/input.twig and layouts/field.twig, field.label is rendered using |raw directly in the label body, allowing immediate execution of tags like <img> with onerror handlers.
Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, restrict the saisie formulaire permission to only the most trusted administrators to minimize the risk of malicious form creation.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-116CWE-79

Related Identifiers

CVE-2026-52772
GHSA-XC7J-3G8Q-9VH4

Affected Products

Yeswiki
Yeswiki/Yeswiki