CVE-2026-52772 YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html'))
Attackers can inject malicious scripts via Bazar form fields, leading to stored XSS and potential account takeover in YesWiki.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52772?
CVE-2026-52772 is a medium-severity cross-site scripting vulnerability in yeswiki, published on 4 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.
Which versions are affected by CVE-2026-52772?
2 open source packages ship an affected version, including yeswiki/yeswiki.
| Package | Affected | Fixed in |
|---|---|---|
yeswiki/yeswiki Packagist | All versions | 4.6.6 |
yeswiki/yeswiki Packagist | All versions | 4.6.6 |
How do I fix CVE-2026-52772?
Upgrade yeswiki/yeswiki to 4.6.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-52772 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52772 exists.
Sources
Also known as GHSA-xc7j-3g8q-9vh4.