{"id":"CVE-2026-52762","title":"YesWiki is a wiki system written in PHP","summary":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Executio…","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-1336"],"vendor":"YesWiki","product":"yeswiki","affected":["yeswiki < 4.6.6"],"patched":["yeswiki/yeswiki 4.6.6"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:05:26.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52762","references":[{"url":"https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-65p8-9433-jpcp"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"epss":0.00779,"epssPercentile":0.53963,"aliases":["GHSA-65p8-9433-jpcp"],"ecosystem":"composer","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T18:00:18.240792Z"},"cvssSource":"cna","ingestedAt":"2026-07-09T21:52:34.706Z","slug":"CVE-2026-52762","body":"## Overview\n\nYesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52762)\n\nAffected packages:\n\n- `yeswiki/yeswiki < 4.6.6`\n\nPatched in:\n\n- `yeswiki/yeswiki 4.6.6`\n\nSource: https://github.com/advisories/GHSA-65p8-9433-jpcp","depth":"midnight","depthScore":51,"depthScoreParts":{"impact":39.1,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":8184,"id":"CVE-2026-52762","ts":1788919972948,"field":"exploit_available","old":"false","new":"true"},{"seq":8183,"id":"CVE-2026-52762","ts":1788919972948,"field":"cvss","old":null,"new":"7.1"},{"seq":7993,"id":"CVE-2026-52762","ts":1788919275379,"field":"exploit_available","old":"true","new":"false"},{"seq":7992,"id":"CVE-2026-52762","ts":1788919275379,"field":"cvss","old":"7.1","new":null},{"seq":7802,"id":"CVE-2026-52762","ts":1788916333557,"field":"exploit_available","old":"false","new":"true"},{"seq":7801,"id":"CVE-2026-52762","ts":1788916333557,"field":"cvss","old":null,"new":"7.1"},{"seq":7611,"id":"CVE-2026-52762","ts":1788915291622,"field":"exploit_available","old":"true","new":"false"},{"seq":7610,"id":"CVE-2026-52762","ts":1788915291622,"field":"cvss","old":"7.1","new":null},{"seq":7420,"id":"CVE-2026-52762","ts":1788912694801,"field":"exploit_available","old":"false","new":"true"},{"seq":7419,"id":"CVE-2026-52762","ts":1788912694801,"field":"cvss","old":null,"new":"7.1"},{"seq":7229,"id":"CVE-2026-52762","ts":1788911323910,"field":"exploit_available","old":"true","new":"false"},{"seq":7228,"id":"CVE-2026-52762","ts":1788911323910,"field":"cvss","old":"7.1","new":null},{"seq":7036,"id":"CVE-2026-52762","ts":1788909060869,"field":"exploit_available","old":"false","new":"true"},{"seq":7035,"id":"CVE-2026-52762","ts":1788909060869,"field":"cvss","old":null,"new":"7.1"},{"seq":6848,"id":"CVE-2026-52762","ts":1788907385469,"field":"exploit_available","old":"true","new":"false"},{"seq":6847,"id":"CVE-2026-52762","ts":1788907385469,"field":"cvss","old":"7.1","new":null},{"seq":6650,"id":"CVE-2026-52762","ts":1788905428280,"field":"exploit_available","old":"false","new":"true"},{"seq":6649,"id":"CVE-2026-52762","ts":1788905428280,"field":"cvss","old":null,"new":"7.1"},{"seq":6468,"id":"CVE-2026-52762","ts":1788903454609,"field":"exploit_available","old":"true","new":"false"},{"seq":6467,"id":"CVE-2026-52762","ts":1788903454609,"field":"cvss","old":"7.1","new":null},{"seq":6263,"id":"CVE-2026-52762","ts":1788901797287,"field":"exploit_available","old":"false","new":"true"},{"seq":6262,"id":"CVE-2026-52762","ts":1788901797287,"field":"cvss","old":null,"new":"7.1"},{"seq":6093,"id":"CVE-2026-52762","ts":1788899557380,"field":"exploit_available","old":"true","new":"false"},{"seq":6092,"id":"CVE-2026-52762","ts":1788899557380,"field":"cvss","old":"7.1","new":null},{"seq":5904,"id":"CVE-2026-52762","ts":1788898149102,"field":"exploit_available","old":"false","new":"true"},{"seq":5903,"id":"CVE-2026-52762","ts":1788898149102,"field":"cvss","old":null,"new":"7.1"},{"seq":5793,"id":"CVE-2026-52762","ts":1788895705169,"field":"exploit_available","old":"true","new":"false"},{"seq":5792,"id":"CVE-2026-52762","ts":1788895705169,"field":"cvss","old":"7.1","new":null},{"seq":5669,"id":"CVE-2026-52762","ts":1788894522456,"field":"exploit_available","old":"false","new":"true"},{"seq":5668,"id":"CVE-2026-52762","ts":1788894522456,"field":"cvss","old":null,"new":"7.1"},{"seq":5627,"id":"CVE-2026-52762","ts":1788891865911,"field":"exploit_available","old":"true","new":"false"},{"seq":5626,"id":"CVE-2026-52762","ts":1788891865911,"field":"cvss","old":"7.1","new":null},{"seq":5593,"id":"CVE-2026-52762","ts":1788890891080,"field":"exploit_available","old":"false","new":"true"},{"seq":5592,"id":"CVE-2026-52762","ts":1788890891080,"field":"cvss","old":null,"new":"7.1"}]}