CVE-2026-52762CWE-1336

CVE-2026-52762

published September 5, 2026

CVSS
7.1
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00779 · 55.5th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2026-09-05T04:17Z
References (4)
https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b · [email protected]https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 · [email protected]https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp · [email protected]https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 04 SEP 23:39Z
    YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
    cvelistv5