CVE-2026-52778: YesWiki Remote Code Execution and Denial of Service via Unsafe eval() in Formula Calculator
Summary
CVE-2026-52778: An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. Affects yeswiki/yeswiki versions < 4.6.6. Fixed in 4.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage collaborative content. It features a Bazar form field calculator that enables users to input mathematical formulas. However, this functionality has a critical vulnerability that exposes the application to severe security risks, including remote code execution and denial of service.
Vulnerability Detail
The vulnerability arises from the use of the PHP eval() function in conjunction with a complex recursive regular expression intended to validate user-defined mathematical formulas. This flawed implementation can lead to Regular Expression Denial of Service (ReDoS) attacks, causing server crashes, and allows attackers to execute arbitrary PHP code if they can bypass the regex validation. The reliance on eval() means that any successful bypass can lead to full host compromise, allowing attackers to read sensitive files, modify application data, and disrupt service availability.
How To Fix
Minimum fixed version
4.6.6
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Bazar form field calculator until the package is updated. Additionally, consider implementing input validation and sanitization measures outside of the eval() context to mitigate potential risks.
Conclusion
CVE-2026-52778 represents a significant security risk for YesWiki users due to its potential for remote code execution and denial of service. It is crucial to update to the patched version to protect against these vulnerabilities and ensure the integrity and availability of your application.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
CVE-2026-52778 is a critical vulnerability in YesWiki that allows for remote code execution and denial of service due to unsafe use of the eval() function in its formula calculator.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The impacts include unauthorized access to sensitive information, modification of application data, and complete service disruption due to server crashes.
Yes, a patch is available in version 4.6.6 of YesWiki. It is recommended to update to this version or later to mitigate the vulnerability.
If immediate updating is not possible, refrain from using the vulnerable features and implement additional input validation and sanitization measures.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
