YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`) (CVE-2026-52772)

Why this deserves its current priority

CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps yeswiki/yeswiki (composer), YesWiki/yeswiki (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
yeswiki/yeswikicomposer	<4.6.6	4.6.6
YesWiki/yeswikigeneric	< 4.6.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for yeswiki/yeswiki, YesWiki/yeswiki.
Review the reported fix. Update yeswiki/yeswiki to 4.6.6 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 10, 2026

Sources and claim methodology

Upstream source description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.

Quoted source text, attributed separately from HOL analysis.

YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)CVE-2026-52772

Key facts