CVE-2026-52774 Scanner

YesWiki is an open-source wiki engine that allows users to create collaborative web environments. It is commonly used by teams and communities to document projects, share information, and collaborate effectively. YesWiki offers various extensions and plugins, providing users the flexibility to enhance the wiki's capabilities. The software is popular among small businesses, educational institutions, and open-source communities owing to its ease of use and customization options. The software supports a range of content management features, allowing users to integrate rich media and interactive widgets into their pages seamlessly. YesWiki's extensible platform is an attractive choice for users seeking a flexible and community-focused collaboration tool.

The vulnerability detected in YesWiki involves the Bazar widget's mishandling of input, specifically the 'id' parameter. The parameter is reflected in HTML attributes using a function that fails to adequately sanitize input, leaving room for injection attacks. Exploiting this vulnerability allows attackers to inject arbitrary JavaScript code into the browser. This type of vulnerability is known as Cross-Site Scripting (XSS), a common attack vector that can lead to significant security risks. XSS vulnerabilities are particularly dangerous because they can be executed without victims' explicit knowledge or permission. The flaw arises from improper handling of user-supplied input, bypassing standard security measures.

Technical specifics of the vulnerability show that the Bazar widget handler in YesWiki reflects the 'id' GET parameter into HTML attributes. The use of the strip_tags() function fails to escape double quotes, allowing for the inclusion of arbitrary event handlers. Utilizing the 'id' parameter in this manner can enable attackers to inject malicious scripts directly into the web page. When processed by victims' browsers, these scripts execute actions as if performed by legitimate users. The vulnerability can be exploited by crafting a specific URL with malicious JavaScript embedded through the 'id' parameter. This bypasses the intended output encoding and directly impacts users interacting with the affected YesWiki instance.

Exploiting the Cross-Site Scripting vulnerability in YesWiki can lead to several harmful effects. An attacker may execute arbitrary scripts within the context of users' browser sessions, potentially stealing cookies or session tokens. Such actions may result in unauthorized access to user accounts and sensitive data. Persistent XSS vulnerabilities can also modify the content or behavior of the affected web page maliciously. Additionally, exploitations could facilitate phishing attacks, further compromising user security. Users may unknowingly interact with or disseminate malicious scripts, extending the potential impact over a wider scope. Overall, this vulnerability poses a significant threat to the integrity and confidentiality of user interactions within YesWiki environments.

REFERENCES

• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-r5xw-gcgw-hwp5
• https://nvd.nist.gov/vuln/detail/CVE-2026-52774