The vulnerability in YesWiki Bazar is a stored Server-Side Template Injection (SSTI) in the semantic template fields (`bn_sem_template` and `bn_sem_reverse_template`). An authenticated administrator can insert arbitrary Twig expressions into these fields, which are stored in the form configuration. When a public semantic endpoint (e.g., GET /api/forms/2/entries/json-ld) is requested, the backend renders these templates using Twig's `createTemplate()->render()` without escaping, executing the injected code server-side. This unsafe rendering allows escalation from template evaluation to remote code execution by invoking system-level callables within Twig. The vulnerability was confirmed by executing harmless arithmetic expressions and then by executing system commands that established an interactive shell on the server. The affected versions are all YesWiki releases before 4.6.6.

An authenticated administrator can inject and store malicious Twig template code that is later executed by the server when public semantic endpoints are accessed. This leads to remote code execution on the server hosting YesWiki, allowing an attacker to execute arbitrary system commands with the privileges of the YesWiki process. The vulnerability is persistent and remotely triggerable, posing a critical risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only. Avoid using the semantic template feature or disable public semantic endpoints if possible to reduce exposure. Monitor vendor channels for updates regarding patches or official mitigations.