The vulnerability arises because Bazar form-field templates in YesWiki apply Twig's raw('html') filter to field.label and field.hint values without proper escaping or sanitization. The field.label is decoded from HTML entities back into raw characters, enabling injection of characters like quotes that break out of HTML attributes. Some templates use raw('html') combined with striptags, which removes tags but not quotes or event handlers, allowing attribute injection. Other templates use raw('html') without striptags, enabling direct tag injection. These fields are sourced from form definitions editable only by users with the 'saisie_formulaire' ACL, typically admins, but the XSS payload executes in the context of any viewer, including unauthenticated users. A prior fix addressed some templates but left at least seven others vulnerable, including base layout templates inherited by all Bazar field types. The vulnerability is tracked as CVE-2026-52772 and GHSA-xc7j-3g8q-9vh4.

An attacker with high privileges (form editor/admin) can inject stored XSS payloads into form field labels and hints. These payloads execute in the security context of any user viewing the affected forms, including unauthenticated visitors, potentially leading to session hijacking, credential theft, or other client-side attacks. The scope is changed because the injection affects other users beyond the attacker. The CVSS score is 4.7 (medium), reflecting limited confidentiality and integrity impact but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The prior commit fixed some templates but left others vulnerable. Until an official fix is released, restrict form definition editing to trusted administrators only and audit existing form definitions for malicious content. Avoid using Twig's raw('html') filter on untrusted input without proper escaping or sanitization. Monitor the YesWiki project for updates addressing the remaining vulnerable templates.