CVE-2026-52773 Scanner

YesWiki is a flexible and user-friendly tool commonly used for managing wikis, allowing users to collaboratively create and manage content on shared platforms. It is predominantly utilized by communities, educators, and organizations needing an adaptable content management system for knowledge sharing and documentation. The software allows for customizing page layouts, integrating multimedia, and configuring user permissions to manage collaborative work effectively. Due to its open-source nature, YesWiki attracts a broad range of contributors and users worldwide, fostering community-driven enhancements and integrations. Moreover, it is particularly valued for its ease of installation and setup, enabling users with minimal technical expertise to deploy and maintain their wiki instances. As a result, YesWiki serves a diverse audience, from small teams to extensive networks requiring a decentralized approach to information sharing.

The vulnerability identified in YesWiki is a Cross-Site Scripting (XSS) attack vector, which can allow attackers to inject malicious JavaScript into web pages viewed by other users. This type of vulnerability is particularly concerning because it exploits the web security weaknesses by manipulating client-side scripts, opening a pathway for potential data theft or unauthorized actions. Attackers exploit this flaw by crafting input data containing harmful scripts that the application inadvertently reflects in its output, effectively bypassing input sanitization mechanisms. The specific vulnerability arises within the archived-revision view, where input parameters are reflected into hidden HTML fields without appropriate escaping. Unchecked, such vulnerabilities can lead to users inadvertently executing attacker-provided scripts during regular interactions with the website. Due to the ease with which XSS can be exploited and the significant impact it can have, patching this type of vulnerability is considered high priority for maintainers.

Technical examination reveals the vulnerability's endpoint in YesWiki occurs at handlers/page/show.php, where a lack of output encoding facilitates the injection of an XSS payload. The unsanitized 'time' GET parameter allows for the inclusion of executable code when combined with valid revision timestamps. This exploitation is made possible because MySQL, which YesWiki uses, coerces malformed DATETIME strings, permitting the appended script to bypass detection. The attacker can manipulate this endpoint to craft requests that present harmful scripts in rendered content, effectively compromising user sessions by exploiting script execution contexts. Given the versatile nature of XSS, crafting an attack involves appending the XSS payload to a legitimate parameter, thus deceiving the application into treating it as legitimate input. In practice, this requires an external user to interact with the manipulated path to trigger the rogue script execution, underlining the complexity and subtlety involved in such attacks.

When leveraged by attackers, the discovered XSS vulnerability in YesWiki can have numerous detrimental effects. Victims may unknowingly execute malicious scripts that enable attackers to hijack user sessions, deface the website, or redirect users to scam sites for phishing purposes. The vulnerability can also serve as a foothold for further attacks, such as session hijacking, credential theft, or even drive-by downloads of malware. These malicious activities may not only harm individual users but can also damage the reputation and trustworthiness of the affected website or organization. In essence, the exploitation of such vulnerabilities underscores the critical necessity of thorough input validation and output encoding mechanisms to prevent unauthorized code execution within user browsers.

REFERENCES

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-35f3-pg38-486f
• https://nvd.nist.gov/vuln/detail/CVE-2026-52773