The vulnerability exists in the tools/bazar/fields/CalcField.php file within the formatValuesBeforeSave($entry) method. The application uses a recursive regex pattern to validate mathematical formulas before executing them with eval(). Due to the recursive nature of the regex, an attacker can craft deeply nested input that exhausts the PCRE recursion limit, causing a server crash (Denial of Service). Furthermore, if the regex validation is bypassed—through fuzzing, edge cases, or PCRE engine bugs—arbitrary PHP code can be executed with web server privileges, leading to full host compromise. The vulnerability affects all YesWiki versions prior to 4.6.6. No official patch or fix link is provided in the advisory, and the vendor has not confirmed remediation status.

Successful exploitation can lead to high confidentiality impact by allowing attackers to read sensitive files such as /etc/passwd and configuration files. Integrity impact is high as attackers can modify application files, inject backdoors, or alter database content. Availability is also highly impacted due to the ability to crash the PHP process via a Regular Expression Denial of Service (ReDoS) attack, rendering the service unavailable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or avoid using the vulnerable Bazar form field calculator feature. Do not rely on regular expressions to sanitize input for eval(). Instead, replace the vulnerable code with a dedicated, safe Abstract Syntax Tree (AST) math parser or a secure expression language component that does not execute system context code.