CVE-2026-52762: YesWiki Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-65p8-9433-jpcp",
  "modified" : "2026-07-09T20:54:23Z",
  "published" : "2026-07-09T20:54:23Z",
  "aliases" : [ "CVE-2026-52762" ],
  "summary" : "YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates",
  "details" : "### Summary\nYesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (`RCE`). An authenticated administrator can place arbitrary Twig expressions into the `Semantic template (Twig)` field (`bn_sem_template`), and that content is later executed server-side when public semantic endpoints are requested.\n\nThis was first confirmed through a harmless proof payload where `{{ 7 * 7 }}` was rendered as `49` through the public JSON-LD endpoint. The finding was then further validated locally by storing a Twig payload that invoked a system-level callable, resulting in command execution and an interactive shell on the test machine.\n\nBecause the payload is stored in the form configuration and later triggered through a public endpoint, this issue is both persistent and remotely triggerable after an administrator plants the malicious template.\n\n### Details\nThe vulnerable behavior is in the Bazar semantic rendering flow.\n\nThe administrator-editable fields:\n\n- `bn_sem_template`\n- `bn_sem_reverse_template`\n\nallow Twig template content to be stored inside a form definition. That content is later rendered by the backend semantic transformer through `TemplateEngine::renderFromStringNoEscape()`, which passes the user-controlled string into Twig for execution.\n\nRelevant sink:\n\n```php\n$json = $this->templateEngine->renderFromStringNoEscape($form['bn_sem_template'], $data);\n```\n\nThe rendering helper evaluates the supplied string as a live Twig template:\n\n```php\npublic function renderFromStringNoEscape(string $templateString, array $data = []): string\n{\n    $wrapped = '{% autoescape false %}' . $templateString . '{% endautoescape %}';\n    return $this->twig->createTemplate($wrapped)->render($data);\n}\n```\n\nThis is unsafe because administrator-controlled semantic template text is executed as server-side Twig code rather than treated as inert data. In the validated environment, Twig expressions were first confirmed to execute through a harmless arithmetic payload and were then escalated to operating-system-level command execution by invoking a callable through Twig.\n\nThe public trigger path used during validation was:\n\n```text\nGET /api/forms/2/entries/json-ld\n```\n\nThe attack chain is:\n\n1. An administrator stores malicious Twig code in the semantic template field.\n2. YesWiki saves that payload in the form configuration.\n3. A later request to the public semantic endpoint causes the backend to render and execute the stored Twig.\n4. Because the Twig environment is not adequately constrained, the stored payload can escalate from template execution to system command execution.\n\n### PoC\nThe following steps reproduce the issue on the locally validated YesWiki instance.\n\n### Stage 1: Confirm Server-Side Template Execution\n\n1. Log in to YesWiki as an administrator.\n2. Open Bazar form management.\n3. Edit form ID `2` (`Agenda` in the validated instance).\n4. Locate the field labeled `Semantic template (Twig)`.\n5. Replace its content with the following harmless payload:\n\n```json\n{\"proof\":\"{{ 7 * 7 }}\"}\n```\n\n6. Save the form.\n7. Trigger the public semantic endpoint:\n\n```bash\ncurl -s 'https://target.example/?api/forms/2/entries/json-ld'\n```\n\n8. Observe that the server returns evaluated Twig output instead of the literal string `{{ 7 * 7 }}`.\n\nConfirmed response:\n\n```json\n{\"@context\":null,\"@id\":\"https:\\/\\/target.example\\/?api\\/fiche\\/2\",\"@type\":[\"ldp:Container\",\"ldp:BasicContainer\"],\"dcterms:title\":\"Agenda\",\"ldp:contains\":[{\"proof\":\"49\",\"id\":\"https:\\/\\/target.example\\/?TesT2\"},{\"proof\":\"49\",\"id\":\"https:\\/\\/target.example\\/?Bordeaux\"}]}\n```\n\nKey execution proof:\n\n```json\n\"proof\":\"49\"\n```\n\n### Stage 2: Confirm Remote Code Execution\n\nAfter confirming SSTI with the harmless payload above, a second locally controlled payload was stored in the same semantic template field to test whether Twig execution could be escalated to command execution. When the public semantic endpoint was requested, the payload executed on the server and established an interactive shell back to the test listener.\n\nObserved local evidence included:\n\n- an inbound connection to the attacker's listener\n- an interactive shell prompt on the YesWiki host\n- successful command execution from the shell inside the YesWiki project directory\n\nObserved shell output:\n\n```text\nConnection received on 172.31.60.19 60308\nkhizar@Victus:/mnt/c/Users/khiza/Documents/Codex/2026-05-24/i-am-trying-to-make-a/yeswiki-src$ ls\nINSTALL.md\nLICENSE\nMakefile\nREADME.md\nSECURITY.md\nactions\ncache\ncodex-admin-login.php\ncomposer.json\ncomposer.lock\ncustom\ndocker\ndocs\nfiles\nformatters\nhandlers\nincludes\nindex.php\ninterwiki.conf\njavascripts\nlang\npackage.json\nprivate\nrobots.txt\nsetup\nstyles\ntemplates\ntests\nthemes\ntools\nvendor\nwakka.config.php\nwakka.php\nyeswicli\n```\n\nThis confirms that the issue is not limited to template evaluation or data disclosure. In the validated local environment, the stored Twig payload reached full operating-system-level command execution.\n\n### Impact\nAn authenticated administrator can inject arbitrary Twig expressions into Bazar semantic templates, and those expressions are executed server-side when public semantic endpoints are requested.\n\nIn the validated environment, this leads to confirmed Remote Code Execution. An attacker with administrator access can:\n\n- execute arbitrary Twig expressions on the server\n- store a persistent payload in form configuration\n- have that payload triggered later by unauthenticated requests to public semantic endpoints\n- execute operating-system commands on the host\n- gain interactive shell access to the underlying server\n- pivot from application-level administration to full server compromise\n\nThis breaks the expected trust boundary between application administration and host-level execution. In practical terms, YesWiki administrator privileges become sufficient to obtain command execution on the server in affected deployments.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "yeswiki/yeswiki"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.6.6"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/YesWiki/yeswiki"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1336" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-09T20:54:23Z",
    "nvd_published_at" : null
  }
}