Threats tagged 'ghsa-65p8-9433-jpcp'

YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in its semantic template feature that allows an authenticated administrator to inject arbitrary Twig template code. This code is executed server-side when public semantic endpoints are accessed, enabling remote code execution (RCE). The vulnerability arises because administrator-controlled Twig templates are rendered without adequate sandboxing or escaping. A proof-of-concept demonstrated both template evaluation and escalation to system-level command execution, resulting in an interactive shell on the server. The issue affects YesWiki versions prior to 4.6.6.