CVE-2026-52778
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
YesWiki before version 4.6.6 contains an unsafe execution vulnerability in the Bazar form field calculator (CalcField.php), where the application attempts to sanitize mathematical formulas using a complex regular expression before passing them to eval(), which is vulnerable to ReDoS and can lead to arbitrary PHP code execution.
Risk Assessment
An attacker can cause server crash (ReDoS) or, after bypassing the filter, remotely execute arbitrary PHP code, leading to full system compromise.
Recommendation
Update YesWiki to version 4.6.6 or later, which includes the fix.
Original NVD description (English source)
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue.