Quick answers
- Is CVE-2026-52777 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-52777 being exploited in the wild.
- How severe is CVE-2026-52777?
- Critical severity, with a CVSS score of 4, published 5 September 2026.
- Which products and versions are affected?
- yeswiki/yeswiki (Packagist) < 4.6.6, ECOSYSTEM:introduced=0,fixed=4.6.6; YesWiki < 4.6.6.
- Is there a fix for CVE-2026-52777?
- Yes. yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-52777 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-52777?
- Check whether you run yeswiki/yeswiki (Packagist) or YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yeswiki/yeswiki (Packagist): upgrade to 4.6.6 or later
composer require yeswiki/yeswiki:^4.6.6
Technical details
A PHP Object Injection vulnerability exists in YesWiki's `CSVManager::importEntry` due to the unsafe use of `unserialize()` on user-supplied data from the `importfiche` POST parameter. The vulnerability is reachable via the `bazarimport` action. While the action requires administrative privileges, it lacks CSRF protection, allowing a remote attacker to perform a Cross-Site Request Forgery attack against a logged-in administrator. By leveraging existing gadget chains in included libraries like Doctrine, an attacker can achieve Remote Code Execution (RCE). The issue is fixed in version 4.6.6 by restricting allowed classes in `unserialize()` and adding CSRF token validation.
Affected products
- YesWiki yeswiki < 4.6.6
Identifiers
- CVE-2026-52777
- GHSA-9369-69wj-7m2f
Timeline
- 2026-06-02: disclosed
- 2026-07-09: advisory
- 2026-07-09: patched