Executive brief
YesWiki, a collaborative wiki platform, contains a security flaw in its site configuration settings. An attacker can inject malicious scripts into the 'meta robots' configuration field, which then execute in the browsers of other users, including high-level administrators. This could lead to unauthorized access to sensitive data, session hijacking, or full account takeover of other wiki users.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in YesWiki v.4.5.4 due to improper neutralization of input in the 'meta robots' configuration field. An attacker with sufficient privileges to modify site configuration (e.g., a lower-privileged administrator) can inject a malicious JavaScript payload into the meta[robots] input field. Because this meta tag is rendered across all wiki pages, the script executes in the context of any user visiting the site. This can be leveraged for session hijacking, credential theft, and privilege escalation. The vulnerability is tracked as CVE-2025-52277 and requires user interaction (a victim viewing a page) to trigger the payload.
Affected products
- YesWiki YesWiki 4.5.4
Timeline
- 2025-09-09: advisory: CVE published by NVD/MITRE
- 2025-09-10: other: CISA-ADP enrichment added CVSS and CWE data