CVE-2026-52778: YesWiki Calculator Eval and ReDoS Vulnerability

Detection and Triage

Detection may be difficult if your current logging does not capture form submissions or application errors in detail. The vulnerable area involves formula processing in the Bazar calculator field, so the highest-value artifacts are requests that create, edit, or submit forms containing unexpectedly complex expressions, deeply nested parentheses, or PHP-like syntax that should never appear in a normal mathematical formula.

You should review web logs, reverse proxy logs, and PHP error logs for signs of malformed or unusually large formula inputs near the time of crashes, 500 responses, or worker restarts. Because the NVD-backed material does not include exact request parameter names, avoid overfitting to one field name. Instead, look for requests touching form creation or submission endpoints combined with suspicious expression strings.

Technical Notes

Start with web and PHP logs around periods of instability:

# Apache or Nginx access logs: look for suspicious formula-like payloads
grep -RIE "(\$\{|\b(eval|system|shell_exec|assert)\b|[()]{8,}|%28%28%28%28|%24%7B)" /var/log/nginx /var/log/apache2 2>/dev/null

# PHP-FPM and PHP error logs: stack overflow, backtracking, fatal errors
grep -RIE "(stack overflow|Allowed memory size exhausted|maximum execution time|preg_|Fatal error)" /var/log/php* /var/log 2>/dev/null

Example suspicious patterns to hunt for:

POST /?Bazar or form-related endpoint ... 500
... formula=((((((((((((1))))))))))))
... formula=${phpinfo()}
... PHP Fatal error:  Allowed memory size exhausted ...
... preg_match(): Compilation failed ...
... child exited on signal 11 (SIGSEGV)

If you use a SIEM, a broad starter query can help identify likely abuse attempts without assuming a specific parameter name:

SELECT timestamp, src_ip, http_method, url, status, user_agent
FROM web_logs
WHERE status IN (500, 502, 503)
  AND (
    url LIKE '%Bazar%'
    OR request_body RLIKE '(\$\{|\b(eval|system|shell_exec|assert)\b|\({8,}|\){8,})'
  )
ORDER BY timestamp DESC;

Because exact exploit syntax is not confirmed in the cited material, defenders should use these as triage patterns, not signatures of record. The right operational assumption is that anomalous formula expressions plus application instability deserve immediate review.

Mitigation and Patching

The confirmed fix is YesWiki 4.6.6. If your deployment is running any version prior to 4.6.6, plan to upgrade immediately. Before changing production, take a backup of the application files, database, and configuration, and document whether custom plugins or local modifications touch Bazar fields. That will reduce rollback risk if your environment has drifted from the standard release.

If you cannot patch immediately, your fallback is to reduce exposure. Restrict access to YesWiki administrative and form-authoring capabilities, especially anywhere the Bazar calculator field can be defined or modified. If operationally possible, disable or remove calculator-based forms until the upgrade is complete. You should also put reverse proxy controls in front of the application to limit unusually large or suspicious form submissions and to reduce unauthenticated reachability where possible.

Technical Notes

If your YesWiki deployment was installed from source or a Git checkout, confirm the current version and upgrade to the fixed tag:

cd /var/www/yeswiki
git fetch --tags
git describe --tags
git checkout v4.6.6

If you deploy with archive releases rather than Git, download and replace the application with the official v4.6.6 release, then follow your normal maintenance process for permissions, cache clears, and service restarts. Because packaging varies, there is no single universal system package command that can be safely prescribed from the cited sources.

As an interim workaround, disable access to the calculator feature path where feasible and gate administrative access at the web tier. Example Nginx control for temporary IP restriction of administrative areas:

location / {
    # normal application traffic
}

location ~* /(admin|bazar) {
    allow 192.0.2.10;
    allow 198.51.100.0/24;
    deny all;
}

After upgrade, restart PHP and web services per your platform:

sudo systemctl restart php-fpm || sudo systemctl restart php8.2-fpm
sudo systemctl restart nginx || sudo systemctl restart apache2

If you cannot identify the exact calculator endpoints, assume the feature may still be reachable through existing forms and prioritize the full upgrade over partial filtering.

Validation After Remediation

After upgrading to YesWiki 4.6.6, verify the deployed version in the application UI or release files and confirm the running code matches the fixed release. Also test existing forms that use Bazar calculator logic to ensure business workflows still operate as expected. A rushed security patch that silently breaks production forms can lead teams to roll back, so include a short post-patch functionality check.

From a security perspective, review logs for any suspicious pre-patch activity. If you saw unexplained crashes, fatal PHP errors, or suspicious formula submissions before upgrading, treat the system as potentially compromised until proven otherwise. Because code execution is a stated possible outcome if sanitization is bypassed, look for indicators such as unexpected PHP files, changed application templates, new scheduled tasks, modified .htaccess or web server configs, and unusual outbound connections from the host.

References

• NVD entry for CVE-2026-52778
• Patch commit: GitHub
• Fixed release: GitHub Releases
• GitHub security advisory: GitHub