CVE-2026-52778

### Summary An unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regular Expression Denial of Service (ReDoS / Stack Overflow) which can crash the server, and it creates a high-risk architecture where any logic bypass directly results in arbitrary PHP code execution. ### Details Affected Component - **File**: tools/bazar/fields/CalcField.php - **Method**: formatValuesBeforeSave($entry) - **Vulnerable Mechanism:** Combination of a complex recursive regex validation followed by eval(). The code attempts to implement a sandbox for mathematical operations by verifying the formula structure before executing it: ``` $regexpToCheckIfMathFormula = '/^((' . $number . '|' . $functions . '\s*\((?1)+\)|\((?1)+\))(?:' . $operators . '(?1))?)+$/'; if (preg_match($regexpToCheckIfMathFormula, $formula)) { $formula = preg_replace('!pi|π!', 'pi()', $formula); try { eval("\$value = $formula;"); // VULNERABLE LINE // ... ``` ### Architectural Flaws **PCRE Stack Overflow & ReDoS (The Immediate Exploit):** The regex definition heavily relies on a recursive pattern (?1)+. In PHP's PCRE engine, deeply nested recursive patterns are processed on the system stack. If an attacker inputs a formula with thousands of nested parentheses or repeating groups, the engine will either trigger a pcre.recursion_limit exhaust (returning false or null) or cause a Segmentation Fault, instantly crashing the PHP process (Denial of Service). **The "Validation-Before-Substitution" Trap:** The regex checks the $formula variable after it has tokenized and reassembled the input string. If any underlying function called during tokenization (like testEntryValue or future updates to getEntryValue) returns or leaks an