YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template (Twig) field (bn_sem_template), and that content is later executed server-side when public semantic endpoints are requested. This issue has been patched in version 4.6.6.

Affected: Packagist: yeswiki/yeswiki

### Summary YesWiki Bazar contains a stored Server-Side Template Injection (`SSTI`) vulnerability in the semantic template feature that can be escalated to confirmed Remote Code Execution (`RCE`). An authenticated administrator can place arbitrary Twig expressions into the `Semantic template (Twig)` field (`bn_sem_template`), and that content is later executed server-side when public semantic endpoints are requested.

This was first confirmed through a harmless proof payload where `{{ 7 * 7 }}` was rendered as `49` through the public JSON-LD endpoint. The finding was then further validated locally by storing a Twig payload that invoked a system-level callable, resulting in command execution and an interactive shell on the test machine.

Because the payload is stored in the form configuration and later triggered through a public endpoint, this issue is both persistent and remotely triggerable after an administrator plants the malicious template.

### Details The vulnerable behavior is in the Bazar semantic rendering flow.

The administrator-editable fields:

- `bn_sem_template` - `bn_sem_reverse_template`

allow Twig template content to be stored inside a form definition. That content is later rendered by the backend semantic transformer through `TemplateEngine::renderFromStringNoEscape()`, which passes the user-controlled string into Twig for execution.

Relevant sink:

```php $json = $this->templateEngine->renderFromStringNoEscape($form['bn_sem_template'], $data); ```

The…