Executive brief
YesWiki, a collaborative wiki platform, contains a vulnerability in its Bazar extension that allows an administrator to inject malicious code into template fields. This code is later executed by the server when certain public pages are accessed, potentially allowing an attacker to take full control of the underlying server. This flaw breaks the security boundary between application management and server-level operations, risking total service compromise.
Technical details
A stored Server-Side Template Injection (SSTI) vulnerability exists in YesWiki's Bazar extension within the 'bn_sem_template' and 'bn_sem_reverse_template' fields. An authenticated administrator can inject arbitrary Twig expressions which are subsequently processed by the 'TemplateEngine::renderFromStringNoEscape()' method without adequate sandboxing. The vulnerability is triggered when the backend renders these templates during requests to public semantic endpoints, such as JSON-LD API paths. Because the Twig environment is unconstrained, an attacker can invoke system-level callables to achieve full Remote Code Execution (RCE) and gain shell access. The issue is addressed in version 4.6.6.
Affected products
- YesWiki yeswiki < 4.6.6
Timeline
- 2026-06-02: disclosed
- 2026-06-02: patched: Fix committed to repository
- 2026-07-09: advisory