Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-05T00:17:20.110Z",
  "pubdate": "2026-09-05T00:17:20.110Z",
  "executiveSummary": "YesWiki prior to version 4.6.6 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the Bazar form-field templates.\nThe vulnerability occurs due to the improper handling of user-supplied data within form field attributes and labels, where the application applies the raw('html') filter to input strings.\nAn unauthenticated or authenticated attacker capable of injecting malicious content into form configurations can execute arbitrary JavaScript in the context of other users' sessions, including administrative sessions.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of legitimate users, and the compromise of sensitive data accessible through the wiki interface.\nThe vulnerability is resolved by updating YesWiki to version 4.6.6, which remediates the insecure filter application.",
  "technicalDetails": "The vulnerability is a stored XSS flaw located in the template rendering engine used by the Bazar module within YesWiki. The root cause is the usage of the raw('html') filter when processing field.label and field.hint properties.\nIn the context of the Bazar form-field templates, the application processes field configurations that include display labels and hints. By design, the template engine is instructed to render these fields directly into the HTML DOM without adequate context-aware sanitization or output encoding.\nBecause the raw('html') filter explicitly disables auto-escaping, any payload injected into the field.label or field.hint attributes is treated as raw HTML by the browser during the render phase. This creates a direct injection vector when these fields are subsequently displayed to users viewing the form.\nThe attack flow proceeds as follows: An attacker with permissions to modify or contribute to form configurations injects a malicious payload, such as <script>alert(document.cookie)</script> or an event handler like <img src=x onerror=javascript:void(0)>, into the label or hint parameters. When a victim loads the affected wiki page containing the Bazar form, the server retrieves the malicious string from the database and renders it into the document object model. The browser executes the injected script, operating under the victim's security context.\nThis vulnerability is particularly dangerous as it allows for persistent exploitation. Since the malicious script is stored in the YesWiki database, it will execute every time the affected form is rendered for any user visiting the page. An attacker can leverage this to steal session cookies, capture CSRF tokens, or perform unauthorized administrative operations if the victim possesses higher privileges.\nThe flaw affects versions of YesWiki prior to 4.6.6. Remediation requires an upgrade to the patched version, which modifies the template engine logic to replace or augment the raw('html') filtering mechanism with secure, context-aware output encoding functions, ensuring that user-controlled labels and hints are treated as plain text rather than executable markup."
}