CVE-2026-52778: Unsafe eval() in YesWiki's Formula Calculator Enables Remote Code Execution
What's the Vulnerability
YesWiki, a PHP-based collaborative wiki platform, contains an unsafe use of PHP's eval() in its Formula Calculator feature, part of the BazaR calculated field logic. Formula expressions supplied to this feature are passed directly into eval() without adequate sanitization, allowing an attacker to inject arbitrary PHP code.
This is a classic CWE-94 (Code Injection) issue, compounded by CWE-1333 (Inefficient Regular Expression Complexity / uncontrolled resource consumption), meaning a crafted formula can either execute attacker-controlled PHP outright or trigger infinite loops and resource exhaustion for a denial-of-service condition. Because the eval() runs in the context of the web server process, successful exploitation can lead to webshell deployment, credential theft, and lateral movement within the environment.
Affected Software
- Vendor/Package: yeswiki/yeswiki (composer)
- Affected versions: prior to 4.6.6
- Fixed version: 4.6.6 (patch date not specified in available data)
The flaw is unauthenticated or low-privilege exploitable — no significant access is required to reach the vulnerable code path, and the CVSS score of 9.8 reflects the critical, network-exploitable nature of the issue.
Exploitation Status
A public proof-of-concept exists for this vulnerability. It is not currently listed as part of CISA's Known Exploited Vulnerabilities (KEV) catalog based on available data, but with a public PoC and a CVSS score of 9.8, defenders should treat this as high-priority: PoC-public issues frequently see rapid weaponization and opportunistic scanning once details circulate, especially for internet-facing wiki deployments.
How Our Detection Catches It
We ship detection logic across seven SIEM platforms for this vulnerability: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL).
At a high level, the detection logic focuses on identifying anomalous requests to YesWiki's BazaR/Formula Calculator endpoints containing patterns consistent with PHP code injection payloads — such as suspicious function calls, string concatenation tricks, or encoding commonly used to smuggle code past naive filters — alongside correlation with subsequent process execution or file-write activity from the web server process where host telemetry (e.g., CrowdStrike) is available. This combination of web request inspection and downstream process/file behavior helps surface both successful RCE attempts and DoS-oriented resource exhaustion probes, while reducing false positives from legitimate formula usage.
Learn More
For the full detection queries, MITRE ATT&CK mapping, and purple team validation guidance for this vulnerability, see the CVE-2026-52778 detection page.