CVE-2026-52778

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-08 19:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-52778

Mitre link : CVE-2026-52778

CVE.ORG link : CVE-2026-52778

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-52778", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52778", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T15:54:35.483833Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "YesWiki", "product": "yeswiki", "versions": [{"status": "affected", "version": "< 4.6.6"}]}]}], "published": "2026-06-08T19:16:46.683", "references": [{"url": "https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52", "source": "security-advisories@github.com"}, {"url": "https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8", "source": "security-advisories@github.com"}, {"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue."}, {"lang": "es", "value": "YesWiki es un sistema wiki escrito en PHP. Antes de la versi\u00f3n 4.6.6, existe una vulnerabilidad de ejecuci\u00f3n insegura en la calculadora de campos de formulario Bazar (CalcField.php) de YesWiki. La aplicaci\u00f3n intenta sanear f\u00f3rmulas matem\u00e1ticas definidas por el usuario utilizando una expresi\u00f3n regular recursiva compleja antes de pasarlas a la funci\u00f3n PHP eval(). Esta implementaci\u00f3n es inherentemente defectuosa: es vulnerable a la denegaci\u00f3n de servicio por expresi\u00f3n regular (ReDoS / desbordamiento de pila) lo que puede bloquear el servidor, y crea una arquitectura de alto riesgo donde cualquier omisi\u00f3n de l\u00f3gica resulta directamente en la ejecuci\u00f3n arbitraria de c\u00f3digo PHP. La versi\u00f3n 4.6.6 corrige el problema."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "security-advisories@github.com"}