High severity · published Sep 4, 2026
CVE-2026-52762
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
7.1
CVSS
0.8%
EPSS
No
On KEV
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YE
yeswiki · YesWiki
< 4.6.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52762
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52762
github.com
https://github.com/YesWiki/yeswiki/commit/89462f1577a8a1fe7fcff75e77b5058a74d8047b
github.com
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
github.com
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-65p8-9433-jpcp
More from yeswiki
9.8
CVE-2026-46670
YesWiki: Unauthenticated SQL Injection
9.8
CVE-2026-52778
YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)
9.8
CVE-2025-46348
YesWiki is a wiki system written in PHP
9.8
CVE-2025-46347
YesWiki is a wiki system written in PHP
9.8
CVE-2018-1000641
YesWiki version <= cercopitheque beta 1 contains a PHP Object Injection vulnerability in Unserialising user entered parameter in i18n.inc.php that can result in execution of code,…