CVE-2026-52762

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection SSTI vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution RCE. An authenticated administrator can place arbitrary Twig...

CVE-2026-52762

YesWiki (PHP wiki system) prior to version 4.6.6 is affected by a stored Server-Side Template Injection (SSTI) in the Bazar semantic template feature. An authenticated administrator can inject arbitrary Twig expressions into the bn_sem_template field, which are later executed server-side via Temp...