Executive brief
YesWiki, a collaborative wiki platform, contains a vulnerability in its Bazar form-building component. A user with administrative or form-editing privileges can inject malicious scripts into form field labels or hints. When other users, including regular visitors, view these forms, the script executes in their browser, potentially allowing the attacker to steal session cookies, hijack accounts, or modify site content.
Technical details
A stored XSS vulnerability exists in YesWiki's Bazar component due to the use of the Twig `|raw` and `|raw('html')` filters on user-controlled `field.label` and `field.hint` variables. While a partial fix was previously implemented, several templates (including base layouts like `layouts/input.twig`) remain affected. The vulnerability occurs in three contexts: attribute breakout in placeholders, tooltip injection in `title`/`alt` attributes, and direct DOM injection in label bodies. An attacker with `saisie_formulaire` permissions (typically admins) can inject arbitrary JavaScript. The issue is exacerbated by `BazarField.php` using `html_entity_decode` on labels, which bypasses standard entity-encoding mitigations. The vulnerability was patched in version 4.6.6 by removing the `raw` filters to allow Twig's auto-escaping to function correctly.
Affected products
- YesWiki YesWiki < 4.6.6
Timeline
- 2026-05-19: other: Partial fix attempted in commit e6b66aa
- 2026-06-02: advisory: GitHub Advisory published
- 2026-07-09: patched: Vulnerability confirmed patched in version 4.6.6