Summary
CVE-2026-52778 is a critical unsafe code execution vulnerability in YesWiki, a PHP-based wiki system, affecting all versions prior to 4.6.6. The flaw resides in the Bazar form field calculator (CalcField.php), where user-supplied mathematical formula input is sanitized through a flawed recursive regular expression before being passed directly to PHP’s eval() function. With a CVSS v3.1 score of 9.8 (Critical), this vulnerability is remotely exploitable with no authentication and no user interaction required, and can result in arbitrary remote code execution (RCE) or denial of service (DoS) on the host server.
Technical details
- Root cause: The
formatValuesBeforeSave()method intools/bazar/fields/CalcField.phpvalidates user-defined formulas using a recursive regular expression pattern containing(?1)+constructs before executing the formula viaeval("$value = $formula;"). This architecture is inherently unsafe regardless of the regex’s correctness. - Attack vector 1 – ReDoS / Stack Overflow (DoS): The recursive regex pattern consumes excessive stack memory when processing deeply nested parenthetical input. A crafted payload with thousands of nested parentheses can trigger a PHP stack overflow, crashing the server process.
- Attack vector 2 – Remote Code Execution (RCE): Any successful bypass of the regex sanitization results in direct execution of arbitrary PHP code by the
eval()call, with the privileges of the web server process. - Attack vector: Network (AV:N) — exploitable over HTTP/HTTPS with no credentials (PR:N) and no victim interaction (UI:N).
- Impact: Full compromise of confidentiality, integrity, and availability of the affected host (C:H/I:H/A:H).
- CWEs: CWE-94 (Improper Control of Generation of Code / Code Injection); CWE-1333 (Inefficient Regular Expression Complexity).
Affected software
- YesWiki all versions prior to 4.6.6 (Doryphore release)
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade YesWiki to version 4.6.6 or later. This release, published on June 2, 2026, patches CVE-2026-52778 along with 12 additional security vulnerabilities, including SQL injection, XSS, SSRF, and authentication bypass issues.
- If patching is not immediately possible: Restrict network access to YesWiki instances so that only trusted users can submit Bazar form entries. Consider temporarily disabling the Bazar calculator field feature at the application level until patching can be completed.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

