PT-2026-104281
CVE-2026-104471
·
تاريخ النشر
2026-10-02
·
تاريخ التحديث
2026-10-02
الوصف من
CVSS 4.0
8.6
عاليةالمقاييسAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
YesWiki versions prior to 4.6.7
Description
Authenticated administrators can perform an unrestricted file upload by using the Bazar CSV import preview. By importing a CSV file where the file or image field references a remote .php URL, an attacker can write remote files into the web-accessible
files/ directory. Because the system does not perform extension checks, the uploaded file can be executed as server-side code.Recommendations
Update YesWiki to version 4.6.7 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾