PHP Signature Vulnerability in YesWiki Versions 4.6.2 to 4.6.5

CVE-2026-52767

What is CVE-2026-52767?

YesWiki, a PHP-based wiki system, contains a logic error in the HttpSignatureService::verifySignature() method that impacts versions 4.6.2 through 4.6.5. The method's use of PHP's openssl_verify() function allows for a bypass due to flawed truthiness evaluation in PHP. When openssl_verify() returns -1, the operation is incorrectly deemed a successful verification, leading to potential processing of malicious payloads. This issue has been resolved in version 4.6.6, which ensures that only valid signatures are accepted.

References