{"id":"CVE-2026-52772","title":"YesWiki is a wiki system written in PHP","summary":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has b…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-79","CWE-116"],"vendor":"YesWiki","product":"yeswiki","affected":["yeswiki < 4.6.6"],"patched":["yeswiki/yeswiki 4.6.6"],"published":"2026-09-05","updated":"2026-09-09","sourceUpdated":"2026-09-09T18:16:58.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52772","references":[{"url":"https://github.com/YesWiki/yeswiki/commit/5d1a4d07fecb0706f33e5dfbbe6ff5ef1892b2a7","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xc7j-3g8q-9vh4","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-xc7j-3g8q-9vh4","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-xc7j-3g8q-9vh4"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T17:43:56.777716Z"},"epss":0.00197,"epssPercentile":0.09703,"aliases":["GHSA-xc7j-3g8q-9vh4"],"ecosystem":"composer","ingestedAt":"2026-07-09T21:52:34.678Z","slug":"CVE-2026-52772","body":"## Overview\n\nYesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52772)\n\nAffected packages:\n\n- `yeswiki/yeswiki < 4.6.6`\n\nPatched in:\n\n- `yeswiki/yeswiki 4.6.6`\n\nSource: https://github.com/advisories/GHSA-xc7j-3g8q-9vh4","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":201743,"id":"CVE-2026-52772","ts":1789399664809,"field":"exploit_available","old":"false","new":"true"},{"seq":200473,"id":"CVE-2026-52772","ts":1789397302175,"field":"exploit_available","old":"true","new":"false"},{"seq":198390,"id":"CVE-2026-52772","ts":1789391890533,"field":"exploit_available","old":"false","new":"true"},{"seq":196186,"id":"CVE-2026-52772","ts":1789383532567,"field":"exploit_available","old":"true","new":"false"},{"seq":195115,"id":"CVE-2026-52772","ts":1789380416026,"field":"exploit_available","old":"false","new":"true"},{"seq":193902,"id":"CVE-2026-52772","ts":1789378412594,"field":"exploit_available","old":"true","new":"false"},{"seq":192689,"id":"CVE-2026-52772","ts":1789376365953,"field":"exploit_available","old":"false","new":"true"},{"seq":191476,"id":"CVE-2026-52772","ts":1789373318567,"field":"exploit_available","old":"true","new":"false"},{"seq":190261,"id":"CVE-2026-52772","ts":1789369252140,"field":"exploit_available","old":"false","new":"true"},{"seq":189048,"id":"CVE-2026-52772","ts":1789368197074,"field":"exploit_available","old":"true","new":"false"},{"seq":187831,"id":"CVE-2026-52772","ts":1789365110333,"field":"exploit_available","old":"false","new":"true"},{"seq":186618,"id":"CVE-2026-52772","ts":1789363186425,"field":"exploit_available","old":"true","new":"false"},{"seq":185404,"id":"CVE-2026-52772","ts":1789361059030,"field":"exploit_available","old":"false","new":"true"},{"seq":184191,"id":"CVE-2026-52772","ts":1789358069127,"field":"exploit_available","old":"true","new":"false"},{"seq":182442,"id":"CVE-2026-52772","ts":1789354188499,"field":"exploit_available","old":"false","new":"true"},{"seq":181235,"id":"CVE-2026-52772","ts":1789353052799,"field":"exploit_available","old":"true","new":"false"},{"seq":180028,"id":"CVE-2026-52772","ts":1789350129159,"field":"exploit_available","old":"false","new":"true"},{"seq":178821,"id":"CVE-2026-52772","ts":1789348015506,"field":"exploit_available","old":"true","new":"false"},{"seq":177614,"id":"CVE-2026-52772","ts":1789346248828,"field":"exploit_available","old":"false","new":"true"},{"seq":176407,"id":"CVE-2026-52772","ts":1789342939942,"field":"exploit_available","old":"true","new":"false"},{"seq":176068,"id":"CVE-2026-52772","ts":1789342384626,"field":"exploit_available","old":"false","new":"true"},{"seq":175729,"id":"CVE-2026-52772","ts":1789338551904,"field":"exploit_available","old":"true","new":"false"},{"seq":174524,"id":"CVE-2026-52772","ts":1789334727477,"field":"exploit_available","old":"false","new":"true"},{"seq":173319,"id":"CVE-2026-52772","ts":1789333426984,"field":"exploit_available","old":"true","new":"false"},{"seq":172133,"id":"CVE-2026-52772","ts":1789330967338,"field":"exploit_available","old":"false","new":"true"},{"seq":170947,"id":"CVE-2026-52772","ts":1789328530862,"field":"exploit_available","old":"true","new":"false"},{"seq":169742,"id":"CVE-2026-52772","ts":1789327029344,"field":"exploit_available","old":"false","new":"true"},{"seq":168537,"id":"CVE-2026-52772","ts":1789323594233,"field":"exploit_available","old":"true","new":"false"},{"seq":167332,"id":"CVE-2026-52772","ts":1789319459510,"field":"exploit_available","old":"false","new":"true"},{"seq":166127,"id":"CVE-2026-52772","ts":1789318479966,"field":"exploit_available","old":"true","new":"false"},{"seq":164922,"id":"CVE-2026-52772","ts":1789315667007,"field":"exploit_available","old":"false","new":"true"},{"seq":163717,"id":"CVE-2026-52772","ts":1789313396323,"field":"exploit_available","old":"true","new":"false"},{"seq":162512,"id":"CVE-2026-52772","ts":1789311774234,"field":"exploit_available","old":"false","new":"true"},{"seq":161307,"id":"CVE-2026-52772","ts":1789308450112,"field":"exploit_available","old":"true","new":"false"},{"seq":160812,"id":"CVE-2026-52772","ts":1789304382598,"field":"exploit_available","old":"false","new":"true"},{"seq":160359,"id":"CVE-2026-52772","ts":1789303932998,"field":"exploit_available","old":"true","new":"false"},{"seq":159420,"id":"CVE-2026-52772","ts":1789300360401,"field":"exploit_available","old":"false","new":"true"},{"seq":158650,"id":"CVE-2026-52772","ts":1789299425459,"field":"exploit_available","old":"true","new":"false"},{"seq":157614,"id":"CVE-2026-52772","ts":1789296552082,"field":"exploit_available","old":"false","new":"true"},{"seq":156409,"id":"CVE-2026-52772","ts":1789294523691,"field":"exploit_available","old":"true","new":"false"},{"seq":155204,"id":"CVE-2026-52772","ts":1789292752418,"field":"exploit_available","old":"false","new":"true"},{"seq":153999,"id":"CVE-2026-52772","ts":1789289509232,"field":"exploit_available","old":"true","new":"false"},{"seq":152649,"id":"CVE-2026-52772","ts":1789281425839,"field":"exploit_available","old":"false","new":"true"},{"seq":152289,"id":"CVE-2026-52772","ts":1789281023387,"field":"exploit_available","old":"true","new":"false"},{"seq":151250,"id":"CVE-2026-52772","ts":1789277505102,"field":"exploit_available","old":"false","new":"true"},{"seq":150211,"id":"CVE-2026-52772","ts":1789276006403,"field":"exploit_available","old":"true","new":"false"},{"seq":149178,"id":"CVE-2026-52772","ts":1789273668533,"field":"exploit_available","old":"false","new":"true"},{"seq":148145,"id":"CVE-2026-52772","ts":1789271035007,"field":"exploit_available","old":"true","new":"false"},{"seq":146181,"id":"CVE-2026-52772","ts":1789269250594,"field":"exploit_available","old":"false","new":"true"},{"seq":140465,"id":"CVE-2026-52772","ts":1789256519083,"field":"exploit_available","old":"true","new":"false"}]}