CVE-2026-52778 Details
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue.
A vulnerability allowing remote code execution and denial-of-service has been identified in YesWiki versions prior to 4.6.6. The issue resides in the Bazar form field calculator, specifically within the 'CalcField.php' file. The vulnerability arises because the application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression. This sanitized input is then passed to the PHP eval() function, creating a high-risk scenario. The regular expression can be exploited to cause a stack overflow, crashing the server, and if the regex validation is bypassed, it allows arbitrary PHP code execution via eval().
Users are advised to upgrade to YesWiki version 4.6.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 8, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52 | [email protected] | Source CodeVendor |
| https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 | [email protected] | Release NotesVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-px5m-h76g-p7p8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.5 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |