CVE-2026-52774: 
PHP vulnerability analysis and mitigation

CVE-2026-52774 is a reflected Cross-Site Scripting (XSS) vulnerability in YesWiki's Bazar widget handler that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting a crafted id GET parameter. The vulnerability affects all yeswiki/yeswiki Composer package versions prior to 4.6.6 (confirmed on the official doryphore 4.6.5 release). It was originally published on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, YesWiki Advisory).

The root cause is improper output encoding (CWE-80 / CWE-79): in tools/bazar/presentation/templates/widget.tpl.html (lines 4–7), the $_GET['id'] value is inserted directly into the data-formid HTML attribute using only strip_tags(), which removes HTML tags but does not escape double quotes. An attacker can terminate the attribute value with a " character and inject arbitrary event handlers (e.g., onmouseover="alert(1)"). A second reflection sink exists in tools/bazar/handlers/__WidgetHandler.php, where the same unsanitized input is embedded into the data-iframeUrl attribute via the $urlParams string. The handler performs no authentication or access-control checks — it only verifies that the id parameter is present — making the route reachable by any unauthenticated visitor as long as the Bazar extension is enabled (GitHub Advisory, YesWiki Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser within the YesWiki origin, enabling session cookie theft, credential harvesting, and unauthorized actions performed on behalf of the victim. Because the vulnerable route requires no authentication, both anonymous visitors and logged-in administrators can be targeted by distributing a crafted URL. If the victim holds an active authenticated session, the attacker can perform privileged actions such as modifying wiki content or accessing sensitive user data (YesWiki Advisory).

A public proof-of-concept URL is documented in the official advisory, requiring no authentication and no valid page tag — only the Bazar extension must be enabled. The EPSS score is 0.039% (12th percentile), indicating low current exploitation probability. A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository (commit 0f6f89cf, included in release v10.4.6), lowering the bar for automated scanning. No in-the-wild exploitation or threat actor attribution has been reported at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Nuclei Templates).

1. Reconnaissance: Identify internet-facing YesWiki instances (version < 4.6.6) using search engines or tools like Shodan/Censys. Confirm the Bazar extension is active by browsing to any page and checking for Bazar-related routes.
2. Craft the payload: Construct a URL that breaks out of the data-formid attribute and injects an event handler, for example:

   http://<target>/NoSuchPage/widget?id=%22%20onmouseover=%22alert(1)%22%20x=%22

   The URL-decoded payload " onmouseover="alert(1)" x=" terminates the attribute and injects a new event handler.
3. Deliver the URL: Send the crafted URL to a victim via phishing email, social engineering, or embed it in a third-party page. No valid page tag or account is required.
4. Trigger execution: When the victim opens the URL in a browser and interacts with the widget element (e.g., moves the mouse over it), the injected JavaScript executes in the YesWiki origin.
5. Achieve objective: Replace alert(1) with a payload to steal session cookies (document.cookie), redirect to a phishing page, or perform authenticated actions on behalf of the victim if they are logged in (YesWiki Advisory).

• Network: HTTP GET requests to /<any_page>/widget?id= containing URL-encoded characters such as %22, %20, or event handler keywords (onmouseover, onerror, onclick) in the id parameter value.
• Logs: Web server access logs showing requests to the /widget handler with anomalous id parameter values containing quote characters or JavaScript event handler strings; HTTP 200 responses to requests with non-existent page tags (e.g., /NoSuchPage/widget?id=...).
• File System: No file-system artifacts are expected for this reflected XSS; however, if the XSS is used to deliver a secondary payload, watch for unexpected script files or exfiltration artifacts in the web root.
• Process: No unusual server-side process behavior is expected, as the vulnerability is client-side; monitor for unusual outbound connections from victim browsers to attacker-controlled infrastructure following interaction with crafted URLs (YesWiki Advisory).

Upgrade yeswiki/yeswiki to version 4.6.6 or later, which replaces the insecure strip_tags() calls with proper urlencode() wrapping in __WidgetHandler.php and replaces the direct $_GET['id'] echo in widget.tpl.html with properly HTML-encoded output. The fix was applied in commit 1aa2710. If an immediate upgrade is not possible, consider disabling the Bazar extension or blocking external access to the /widget route via web server configuration as a temporary workaround (GitHub Fix Commit, GitHub Advisory).

The vulnerability was reported by security researcher hash3liZer and published by YesWiki maintainer mrflos on June 2, 2026. A Nuclei detection template was contributed to the ProjectDiscovery community templates repository shortly after disclosure, indicating active interest from the security scanning community. No broader media coverage or significant social media discussion has been identified beyond the advisory and OSV database entries (YesWiki Advisory, Nuclei Templates).