What is the CVSS score of CVE-2026-52778?

CVE-2026-52778 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of YesWiki are affected by CVE-2026-52778?

YesWiki prior to version 4.6.6 contains a critical vulnerability allowing unauthenticated remote code execution, enabling attackers to completely compromise any affected server.. A patch is available.

Is there a public PoC exploit available for CVE-2026-52778?

Yes, a public proof-of-concept exploit is available for CVE-2026-52778. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-52778?

Within 24 hours: Identify all YesWiki deployments and current versions; implement network access controls restricting Bazar CalcField endpoints to authenticated users; enable enhanced logging on affected systems. Within 7 days: Complete upgrade testing of YesWiki 4.6.6 or later in staging; prepare change windows and stakeholder communications. Within 30 days: Complete production deployment of YesWiki 4.6.6 or later across all instances.

YesWiki CVE-2026-52778

EUVD-2026-35181 CRITICAL

Code Injection (CWE-94)

2026-06-08 GitHub_M

GHSA-px5m-h76g-p7p8

PHP Code Injection Denial Of Service RCE Yeswiki

9.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 08, 2026 - 20:01 EUVD

Source Code Evidence Fetched

Jun 08, 2026 - 19:20 vuln.today

Analysis Generated

Jun 08, 2026 - 19:20 vuln.today

DescriptionCVE.org

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. Version 4.6.6 patches the issue.

Articles & Coverage 1

News Critical RCE in YesWiki PHP via Bazar CalcField Eval Injection - CVE-2026-52778 Jun 09, 2026

AnalysisAI

Remote code execution in YesWiki prior to 4.6.6 allows unauthenticated attackers to inject arbitrary PHP via the Bazar CalcField formula evaluator, which sanitizes input with a recursive regex before passing it to eval(). The same flawed regex is also vulnerable to ReDoS/stack overflow, enabling denial of service against the server. No public exploit identified at time of analysis, but the commit diff in 4.6.6 fully documents the vulnerable code path, lowering the bar for exploit development.

Technical ContextAI

YesWiki is a PHP-based collaborative wiki platform. The Bazar module's CalcField (tools/bazar/fields/CalcField.php) lets form designers embed mathematical formulas that are computed at save time. Pre-patch, the code built a heavily recursive PCRE pattern (using subroutine reference (?1)) to validate that input looks like a math expression, then concatenated the raw formula string directly into eval("\$value = $formula;"). This is a textbook CWE-94 (Improper Control of Generation of Code / Code Injection) pattern: any character class or grouping bug in the validator becomes direct PHP execution. Recursive PCRE patterns of this shape are also a known ReDoS class - pathological nesting can exhaust PCRE's backtrack/recursion stack and crash the PHP worker. The fix replaces the eval pipeline with a hand-written tokenizer and recursive-descent parser limited to an ALLOWED_FUNCTIONS whitelist (sin, cos, sqrt, etc.), eliminating both eval and the catastrophic regex.

RemediationAI

Vendor-released patch: upgrade YesWiki to version 4.6.6 or later, which rewrites CalcField.php to use a tokenizer and recursive-descent parser with an explicit function whitelist instead of eval(); see release https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 and the fix commit https://github.com/YesWiki/yeswiki/commit/dd2bd8fb099de0d21504bda8a810693b3fcb8e52. If immediate upgrade is not possible, audit Bazar forms and remove or disable any CalcField (calculator) fields - this loses the calculation feature in those forms but eliminates the vulnerable code path entirely; alternatively, restrict form-submission permissions to authenticated trusted users via Bazar/YesWiki ACLs to reduce exposure, accepting that any authenticated form contributor remains a viable attacker. Place the application behind a WAF rule that rejects form field bodies containing PHP function-call patterns (e.g. backticks, $, ;, dollar-variable syntax) as a stopgap, noting this will produce false positives on legitimate text fields and is bypassable.