Attack Chain

1. An authenticated YesWiki administrator accesses the Bazar form management interface to edit an existing form (e.g., form ID 2).
2. The administrator crafts and injects a malicious Twig expression (e.g., a reverse shell payload or a system() call) into the Semantic template (Twig) field (bn_sem_template or bn_sem_reverse_template).
3. YesWiki's backend saves this malicious payload in the application's form configuration database, establishing persistence.
4. A subsequent HTTP GET request, which can be unauthenticated, is made to a public semantic endpoint, such as /api/forms/{id}/entries/json-ld (e.g., GET /api/forms/2/entries/json-ld).
5. The YesWiki application attempts to render the form's semantic template using the vulnerable TemplateEngine::renderFromStringNoEscape() function.
6. During the rendering process, the server-side Twig engine processes and executes the previously stored malicious expression, leading to the execution of arbitrary system commands on the server.
7. The attacker receives an inbound connection (e.g., a reverse shell), establishing an interactive shell session on the YesWiki host.
8. The attacker gains full operating-system-level control over the underlying server, enabling further actions like lateral movement or data exfiltration.

Impact

Successful exploitation of CVE-2026-52762 allows an authenticated administrator to achieve full Remote Code Execution on the YesWiki server. This critical vulnerability breaks the expected trust boundary, enabling an attacker with administrative application access to pivot to full interactive shell access and system-level compromise. The consequences include unauthorized access to sensitive data, modification or deletion of system files, deployment of malware, and complete control over the compromised server, effectively bypassing application-level security controls.

Recommendation

• Immediately upgrade YesWiki to version 4.6.6 or later to apply the patch for CVE-2026-52762.
• Deploy the provided Sigma rule to your SIEM to detect suspicious process creation indicative of post-exploitation RCE attempts originating from the web server.
• Review web server logs for suspicious HTTP requests to /api/forms/*/entries/json-ld that may indicate exploitation attempts, especially if followed by unusual outbound network activity from the web server's host.