CVE-2026-52777: YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImport

Executive brief

YesWiki, a collaborative wiki platform, is vulnerable to a critical security flaw in its Bazar import tool. An attacker can trick a wiki administrator into visiting a malicious website, which then silently triggers a command on the wiki server. This could allow the attacker to take full control of the server, steal sensitive data, or disrupt the website's operations.

Technical details

A PHP Object Injection vulnerability exists in YesWiki's `CSVManager::importEntry` due to the unsafe use of `unserialize()` on user-supplied data from the `importfiche` POST parameter. The vulnerability is reachable via the `bazarimport` action. While the action requires administrative privileges, it lacks CSRF protection, allowing a remote attacker to perform a Cross-Site Request Forgery attack against a logged-in administrator. By leveraging existing gadget chains in included libraries like Doctrine, an attacker can achieve Remote Code Execution (RCE). The issue is fixed in version 4.6.6 by restricting allowed classes in `unserialize()` and adding CSRF token validation.

Affected products

• YesWiki yeswiki < 4.6.6

Timeline

• 2026-06-02: disclosed
• 2026-07-09: advisory
• 2026-07-09: patched

References

• https://api.github.com/users/fg0x0
• https://github.com/fg0x0
• https://api.github.com/users/fg0x0/gists%7B/gist_id%7D
• https://api.github.com/users/fg0x0/repos
• https://avatars.githubusercontent.com/u/35772301?v=4
• https://api.github.com/users/fg0x0/events%7B/privacy%7D