CVE-2026-52772: 
PHP vulnerability analysis and mitigation

CVE-2026-52772 is a stored Cross-Site Scripting (XSS) vulnerability in YesWiki's Bazar module, where multiple Twig form-field templates apply the |raw('html') filter to field.label and field.hint values in both HTML attribute and label-body contexts without proper sanitization. A prior partial fix (commit e6b66aa, 2026-05-19) addressed only two specific template call sites (text.twig and textarea.twig placeholders), leaving at least seven additional templates exploitable. The vulnerability affects YesWiki versions prior to 4.6.6 (Composer package yeswiki/yeswiki). It was first published as a security advisory on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026. The CVSS v3.1 base score is 5.5 (Moderate) (GitHub Advisory, YesWiki Advisory).

The root cause is CWE-79 (Stored XSS) via CWE-116 (Improper Encoding or Escaping of Output). In BazarField.php, field.label is populated via html_entity_decode(), which actively converts entity-encoded characters (e.g., " → ") back to raw characters, defeating any entity-based mitigation. Both field.label and field.hint then flow unescaped into Twig templates that apply |raw('html'), which marks the value as a Twig\Markup object and suppresses Twig's HTML auto-escaper. Three sink classes exist: (B) attribute-context with |raw('html')|striptags — striptags removes <…> tags but not ", enabling attribute breakout via payloads like hi" onmouseover="alert(document.cookie)" x="; (C) attribute-context with |raw('html') and no striptags — allows full HTML injection via "><script>alert(1)</script>; and (D) label-body context with |raw and no filtering — allows direct DOM injection of arbitrary tags like <img src=x onerror=alert(1)>. The layouts/input.twig and layouts/field.twig base templates are inherited by every Bazar field type, meaning a single malicious field.hint propagates to every form render across the wiki (GitHub Advisory, YesWiki Advisory).

Successful exploitation results in stored XSS executing in the wiki's origin context against every visitor of any Bazar form page, including unauthenticated guests. Consequences include session cookie theft, admin session hijacking, full wiki content modification, and phishing overlay injection. Because the universal sink in layouts/input.twig is inherited by every field type, a single malicious field definition poisons all form renders site-wide. Additionally, the vulnerability is composable with a separately reported unpatched POI/CSRF in BazarImportAction, enabling an XSS → POI → RCE chain without requiring the attacker to phish an admin to a third-party origin (GitHub Advisory, YesWiki Advisory).

No public exploit kit or active in-the-wild exploitation has been reported. The EPSS score is 0.034% (11th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges (saisie_formulaire ACL, granted to admins by default), though deployments that extend this ACL to non-admin user groups lower the effective privilege bar. A detailed proof-of-concept is included in the public advisory, covering both attribute-breakout and label-body injection vectors (GitHub Advisory).

1. Gain privileged access: Log in to the YesWiki instance as an administrator or as any user with the saisie_formulaire ACL (configurable per deployment via config['permissions']['action']['saisie_formulaire']).
2. Navigate to form editor: Go to Bazar → Formulaires → Nouveau formulaire and create or edit an existing form.
3. Inject payload into field label (Sink B — attribute breakout): Add a field of type range or email and set its label to: Enter value" onmouseover="alert(document.cookie)" x=". Save the form. When any visitor hovers the rendered input, the injected onmouseover handler fires.
4. Inject payload into field hint (Sink C — no-interaction script execution): Set the field's hint (Aide) to: "><script>alert('XSS')</script>. Save the form. Because layouts/input.twig is the base layout for every field type, this payload executes immediately on page load for every visitor of any form on the wiki, with no user interaction required.
5. Inject payload into label body (Sink D — direct DOM injection): Set the field label to: <img src=x onerror=alert(1)>. The |raw filter in layouts/input.twig:9 and layouts/field.twig:5 renders this tag directly into the DOM, firing onerror on page load.
6. Harvest credentials or escalate: Use the executing script to exfiltrate session cookies, perform CSRF-token-fetching for chaining with the BazarImportAction POI/CSRF vulnerability, or inject phishing overlays targeting admin users (GitHub Advisory, YesWiki Advisory).

• Logs: Web server access logs showing POST requests to Bazar form-definition endpoints (e.g., /wakka.php?wiki=BazarListe&action=saisie_formulaire) containing URL-encoded XSS payloads in label or hint parameters (e.g., %22, onmouseover, onerror, <script>).
• File System: Unexpected modifications to Bazar form definition files or database records containing raw HTML event handlers (onmouseover=, onerror=, <script>) in field label or hint fields.
• Network: Outbound HTTP requests from the wiki server or from visitor browsers to attacker-controlled domains (e.g., cookie exfiltration endpoints) originating from pages rendering Bazar forms.
• Application Behavior: Bazar form pages triggering JavaScript alerts, unexpected redirects, or loading external resources (images, scripts) from unknown origins upon render — particularly without any user interaction.

Upgrade to YesWiki version 4.6.6 or later, which applies the fix via commit 5d1a4d0. The patch sanitizes field.label at construction time in BazarField.php using HtmlPurifierService::cleanHTML() and removes the |raw('html') filter from attribute contexts across all affected templates (range.twig, email.twig, textarea.twig, user.twig, bookmarklet.twig, layouts/input.twig), replacing it with |striptags|trim. For label-body contexts, the fix relies on the upstream HtmlPurifierService sanitization so that |raw emits already-purified HTML. As a temporary workaround for sites that cannot upgrade immediately, restrict the saisie_formulaire ACL to the minimum necessary set of trusted administrators and audit existing form definitions for malicious label/hint values. Adding a CI grep check for |raw('html') and |raw inside Bazar Twig templates is recommended to prevent future reintroduction (GitHub Advisory, Fix Commit).