CVE-2026-52773: 
PHP vulnerability analysis and mitigation

CVE-2026-52773 is a reflected Cross-Site Scripting (XSS) vulnerability in YesWiki's archived-revision view, where the time GET parameter is reflected into a hidden HTML input in handlers/page/show.php without output escaping. It affects YesWiki (Composer package yeswiki/yeswiki) versions >= 4.1.0 and < 4.6.6, with exploitation confirmed on the official doryphore 4.6.5 release. The vulnerability was originally reported by researcher hash3liZer, published to the GitHub Advisory Database on July 9, 2026, and assigned GHSA-35f3-pg38-486f. It carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, YesWiki Advisory).

The root cause is CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page / Basic XSS): handlers/page/show.php copies $_GET['time'] directly into a hidden HTML form input without calling htmlspecialchars(). The routing path in includes/YesWiki.php passes the raw time parameter to PageManager::getOne(), which builds a SQL predicate using the value; MySQL's DATETIME coercion allows a malformed timestamp (e.g., 2026-05-24 04:30:00"><script>alert(1)</script>) to still match an archived revision row, so the page loads successfully and the tainted value reaches the HTML sink. The vulnerable code path is only triggered when the target page has at least one archived revision and the victim has both read and write access — conditions that are met by default for anonymous users on public pages in a standard doryphore 4.6.5 install. Notably, the Bazar module's equivalent handler (tools/bazar/handlers/page/show__.php) correctly applies htmlspecialchars(), demonstrating an inconsistency in the codebase (Github Advisory, YesWiki Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the YesWiki origin. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as editing wiki pages), and abuse of the trusted origin for phishing or UI redressing attacks. Availability is not impacted, but both confidentiality (browser-accessible data exposure) and integrity (unauthorized in-session actions) are affected (Github Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating exploitation via a crafted URL on a default doryphore 4.6.5 install without authentication on publicly editable pages. The EPSS score is 0.031% (10th percentile), indicating low current exploitation probability. A Nuclei template for automated detection was committed to the ProjectDiscovery nuclei-templates repository, lowering the bar for scanning. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory, Nuclei Templates).

1. Reconnaissance: Identify a YesWiki instance running a vulnerable version (>= 4.1.0, < 4.6.6) using tools like Shodan, Censys, or the available Nuclei template targeting the doryphore release.
2. Identify a target page with archived revisions: Browse the wiki for any page that has revision history (i.e., at least one archived revision). The default PagePrincipale page on a standard install is a reliable candidate.
3. Determine an archived revision timestamp: Access the page's revision history to obtain a valid archived revision timestamp (e.g., 2026-05-24 04:30:00).
4. Craft the malicious URL: Append an HTML/JavaScript payload after the valid timestamp, breaking out of the hidden input's value attribute. URL-encode the payload:

   http://<target>/PagePrincipale?time=2026-05-24%2004:30:00%22%3E%3Cscript%3Ealert(1)%3C/script%3E%3Cinput%20value=%22

5. Deliver the link to the victim: Send the crafted URL to a victim who has read and write access to the target page (on default installs, anonymous users qualify for public pages).
6. JavaScript executes: When the victim opens the URL, YesWiki loads the archived revision (MySQL coerces the malformed timestamp to match the stored row), reflects the unescaped time value into the hidden form field, and the browser executes the injected script in the YesWiki origin — enabling session theft, credential harvesting, or further actions (Github Advisory, YesWiki Advisory).

• Network: HTTP GET requests to YesWiki pages containing a time parameter with URL-encoded HTML special characters (e.g., %22, %3E, %3C, %2F, script) appended after a valid DATETIME string pattern (YYYY-MM-DD HH:MM:SS).
• Logs: Web server access logs showing requests such as GET /PagePrincipale?time=2026-05-24+04%3A30%3A00%22%3E%3Cscript%3E... with HTTP 200 responses, indicating the archived revision was successfully loaded with the malicious payload.
• Logs: Unusual referrer chains or repeated requests to the same page with varying time parameter values, potentially indicating automated scanning (e.g., via Nuclei templates).
• File System: Presence of Nuclei scan artifacts or logs referencing the CVE-2026-52773 template on attacker-controlled infrastructure.

Upgrade to YesWiki version 4.6.6 or later, which applies the fix by wrapping $_GET['time'] with htmlspecialchars() before rendering it into the hidden HTML input in handlers/page/show.php (commit 35ad9c2). As a temporary workaround where upgrading is not immediately possible, administrators should restrict write access to sensitive pages so that anonymous or low-privilege users cannot edit them, which prevents the vulnerable code path from being reached. Disabling anonymous editing on all public pages eliminates the unauthenticated exploitation scenario (Github Advisory, Fix Commit).