YesWiki, a PHP-based wiki platform, contains an unsafe use of PHP eval() in the Bazar form field calculator (CalcField.php). The system attempts to sanitize user-defined formulas with a complex regular expression before passing them to eval(). This sanitization is flawed, allowing attackers to craft formulas that trigger a Regular Expression Denial of Service (ReDoS) causing a stack overflow and server crash, or bypass the filter to execute arbitrary PHP code. The vulnerability is identified as CWE-1333 and CWE-94.

Heretofore versions of YesWiki prior to 4.6.6 are affected. This includes all installations running any date earlier than the 4.6.6 release. The vulnerability exists in the Bazar form feature, so any deployment that has this component enabled is at risk.

The CVSS score of 9.8 indicates critical severity. While EPSS data is not available, the lack of a known exploit in the KEV catalog does not mitigate the threat; the flaw can be exploited by submitting malicious formulas through the web interface, potentially from unauthenticated users if the form is publicly accessible. The attacker does not need elevated privileges, making the threat of remote code execution and Denial of Service high for exposed instances. The likely attack vector is remote submission of crafted formulas through the public Bazar form.