Is CVE-2026-104471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104471 being exploited in the wild.

How severe is CVE-2026-104471?

High severity, with a CVSS score of 7.2, published 2 October 2026.

How is CVE-2026-104471 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104471?

Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104471: YesWiki unrestricted file upload in Bazar CSV import

CVE-2026-104471 · Severity: high · CVSS 7.2 · Published 2026-10-02

YesWiki is a collaborative wiki platform that allows administrators to manage structured data through Bazar forms. An authenticated admin can upload arbitrary remote files—including executable PHP scripts—into the web-accessible storage directory by importing a specially crafted CSV file, leading to remote code execution on the server. This affects deployments with standard web server configurations that execute PHP in the upload directory.

Technologies: YesWiki. Vendors: YesWiki.

Quick answers

Is CVE-2026-104471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104471 being exploited in the wild.
How severe is CVE-2026-104471?: High severity, with a CVSS score of 7.2, published 2 October 2026.
Which products and versions are affected?: YesWiki before 4.6.7.
Is there a fix for CVE-2026-104471?: Yes: fixed in 4.6.7. Until then: Restrict the Bazar import action's access control list (ACL) to trusted administrators only, and disable PHP execution in the files/ directory via web server configuration (e.g., deny *.php in nginx location rules for /files). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104471 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104471?: Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.6.7

Restrict the Bazar import action's access control list (ACL) to trusted administrators only, and disable PHP execution in the files/ directory via web server configuration (e.g., deny *.php in nginx location rules for /files).

Technical details

The Bazar CSV import preview feature in CSVManager.php downloads remote URLs referenced in file and image fields directly into the files/ directory without validating extensions or content type, bypassing the normal upload allowlist. The vulnerable code path (tools/bazar/actions/BazarImportAction.php and tools/bazar/services/CSVManager.php) calls renameUrlToSanitizedFilename() which sanitizes only the basename but does not restrict file extensions, then writes the remote response body via copyUrlToLocalFile(). An authenticated admin with Bazar import privileges can craft a CSV that references a .php URL, causing it to be saved as files/*.php and executed by the web server.

Affected products

YesWiki YesWiki before 4.6.7

Timeline

2026-09-01: disclosed
2026-10-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.