---
id: CVE-2026-52762
title: YesWiki is a wiki system written in PHP
summary: >-
  YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar
  contains a stored Server-Side Template Injection (SSTI) vulnerability in the
  semantic template feature that can be escalated to confirmed Remote Code
  Executio…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-1336
vendor: YesWiki
product: yeswiki
affected:
  - yeswiki < 4.6.6
patched:
  - yeswiki/yeswiki 4.6.6
published: '2026-09-05'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:05:26.920'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52762'
references:
  - url: >-
      https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b
    label: security-advisories@github.com
  - url: 'https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6'
    label: security-advisories@github.com
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp'
    label: security-advisories@github.com
  - url: 'https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-65p8-9433-jpcp'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - composer
epss: 0.00779
epssPercentile: 0.54031
aliases:
  - GHSA-65p8-9433-jpcp
ecosystem: composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-08T18:00:18.240792Z'
cvssSource: cna
ingestedAt: '2026-07-09T21:52:34.706Z'
---

## Overview

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-52762)

Affected packages:

- `yeswiki/yeswiki < 4.6.6`

Patched in:

- `yeswiki/yeswiki 4.6.6`

Source: https://github.com/advisories/GHSA-65p8-9433-jpcp