CVE-2026-52762

YesWiki (PHP wiki system) prior to version 4.6.6 is affected by a stored Server-Side Template Injection (SSTI) in the Bazar semantic template feature. An authenticated administrator can inject arbitrary Twig expressions into the bn_sem_template field, which are later executed server-side via Temp...