Packagist · yeswiki/yeswiki
YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates
YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested.
This was first confirmed through a harmless proof payload where {{ 7 * 7 }} was rendered as 49 through the public JSON-LD endpoint. The finding was then further validated locally by storing a Twig payload that invoked a system-level callable, resulting in command execution and an interactive shell on the test machine.
Because the payload is stored in the form configuration and later triggered through a public endpoint, this issue is both persistent and remotely triggerable after an administrator plants the malicious template.
The vulnerable behavior is in the Bazar semantic rendering flow.
The administrator-editable fields:
bn_sem_templatebn_sem_reverse_templateallow Twig template content to be stored inside a form definition. That content is later rendered by the backend semantic transformer through TemplateEngine::renderFromStringNoEscape(), which passes the user-controlled string into Twig for execution.
Relevant sink:
$json = $this->templateEngine->renderFromStringNoEscape($form['bn_sem_template'], $data);
The rendering helper evaluates the supplied string as a live Twig template:
public function renderFromStringNoEscape(string $templateString, array $data = []): string
{
$wrapped = '{% autoescape false %}' . $templateString . '{% endautoescape %}';
return $this->twig->createTemplate($wrapped)->render($data);
}
This is unsafe because administrator-controlled semantic template text is executed as server-side Twig code rather than treated as inert data. In the validated environment, Twig expressions were first confirmed to execute through a harmless arithmetic payload and were then escalated to operating-system-level command execution by invoking a callable through Twig.
The public trigger path used during validation was:
GET /api/forms/2/entries/json-ld
The attack chain is:
The following steps reproduce the issue on the locally validated YesWiki instance.
2 (Agenda in the validated instance).Semantic template (Twig).{"proof":"{{ 7 * 7 }}"}
curl -s 'https://target.example/?api/forms/2/entries/json-ld'
{{ 7 * 7 }}.Confirmed response:
{"@context":null,"@id":"https:\/\/target.example\/?api\/fiche\/2","@type":["ldp:Container","ldp:BasicContainer"],"dcterms:title":"Agenda","ldp:contains":[{"proof":"49","id":"https:\/\/target.example\/?TesT2"},{"proof":"49","id":"https:\/\/target.example\/?Bordeaux"}]}
Key execution proof:
"proof":"49"
After confirming SSTI with the harmless payload above, a second locally controlled payload was stored in the same semantic template field to test whether Twig execution could be escalated to command execution. When the public semantic endpoint was requested, the payload executed on the server and established an interactive shell back to the test listener.
Observed local evidence included:
Observed shell output:
Connection received on 172.31.60.19 60308
khizar@Victus:/mnt/c/Users/khiza/Documents/Codex/2026-05-24/i-am-trying-to-make-a/yeswiki-src$ ls
INSTALL.md
LICENSE
Makefile
README.md
SECURITY.md
actions
cache
codex-admin-login.php
composer.json
composer.lock
custom
docker
docs
files
formatters
handlers
includes
index.php
interwiki.conf
javascripts
lang
package.json
private
robots.txt
setup
styles
templates
tests
themes
tools
vendor
wakka.config.php
wakka.php
yeswicli
This confirms that the issue is not limited to template evaluation or data disclosure. In the validated local environment, the stored Twig payload reached full operating-system-level command execution.
An authenticated administrator can inject arbitrary Twig expressions into Bazar semantic templates, and those expressions are executed server-side when public semantic endpoints are requested.
In the validated environment, this leads to confirmed Remote Code Execution. An attacker with administrator access can:
This breaks the expected trust boundary between application administration and host-level execution. In practical terms, YesWiki administrator privileges become sufficient to obtain command execution on the server in affected deployments.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.