CVE-2026-52777: YesWiki Authenticated PHP Object Injection Vulnerability in BazarImportAction
Summary
CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize. Affects yeswiki/yeswiki versions < 4.6.6. Fixed in 4.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
YesWiki is an open-source wiki software that allows users to create and manage content collaboratively. It features a user-friendly interface and supports various plugins and extensions. However, a critical vulnerability has been identified in the BazarImportAction component, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability arises from an authenticated PHP object injection in the BazarImportAction class, specifically in the importEntry method. This method uses unserialize without restricting allowed classes, allowing attackers to instantiate arbitrary classes. The vulnerability is reachable through a crafted POST request, enabling remote code execution on the server. The lack of CSRF protection further exacerbates the risk, as it allows attackers to exploit the vulnerability without requiring direct interaction from the admin user.
How To Fix
Minimum fixed version
4.6.6
This is the first release that contains the fix.
composer require yeswiki/yeswiki:4.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to sanitize the $_POST['importfiche'] input before processing it. However, this is not a complete solution and should not replace the necessary patch.
Conclusion
The CVE-2026-52777 vulnerability in YesWiki poses a significant risk to authenticated admin users, enabling remote code execution through PHP object injection. It is crucial to update to the patched version and implement recommended security measures to mitigate this risk.
See every vulnerability recorded for yeswiki/yeswiki →
FAQ
The CVSS score of this vulnerability is 9.4, indicating a critical level of severity.
Authenticated users with admin privileges on YesWiki installations are at risk if they interact with the vulnerable BazarImportAction.
Yes, an attacker can exploit this vulnerability remotely by tricking an admin user into visiting a malicious page that sends a crafted POST request.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to remote code execution on the YesWiki server, allowing attackers to gain full control over the hosting environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for yeswiki/yeswiki.
