CVE-2026-52762highCWE-1336

CVE-2026-52762: high-severity vulnerability in yeswiki

YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

Published · Updated

Follow this CVE+ Monitor yeswiki+ Monitor yeswiki/yeswiki

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.8%
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
YesWiki · yeswiki
Related CVEs — yeswiki

In the same product, most dangerous first.

CVE-2025-31131HIGHPath Traversal allowing arbitrary read of files in YeswikiEPSS 5.6%CVE-2026-46670CRITICALYesWiki: Unauthenticated SQL InjectionEPSS 2.0%CVE-2025-46347MEDIUMYesWiki Remote Code Execution via Arbitrary PHP File Write and ExecutionEPSS 1.0%CVE-2026-52778CRITICALYesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)EPSS 0.8%CVE-2025-46348CRITICALYesWiki Vulnerable to Unauthenticated Site Backup Creation and DownloadEPSS 0.7%CVE-2026-52774MEDIUMReflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWikiEPSS 0.7%