CVE-2026-104471

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description Authenticated administrators can perform an unrestricted file upload by using the Bazar CSV import preview. By importing a CSV file where the file or image field references a remote .php URL, an attacker can write remote files into the web-accessible files/ directory. Because the system does not perform extension checks, the uploaded file can be executed as server-side code.

Recommendations Update YesWiki to version 4.6.7 or later.