CVE-2026-52777

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.6

Description An authenticated PHP object injection issue exists in the BazarImportAction component. The problem occurs because the importEntry() function in tools/bazar/services/CSVManager.php uses the unserialize() function on data provided by the user without restricting allowed classes. This allows an attacker to instantiate arbitrary classes and trigger magic methods, such as toString and destruct, which can be leveraged via gadget chains to achieve remote code execution on the server.

The issue is reachable via the ?BazaR&vue=importer&id typeannonce=<N> endpoint. An attacker can exploit this by sending a specially crafted request containing a base64-encoded payload in the importfiche parameter. Because the action lacks CSRF protection, a remote attacker could trick an authenticated administrator into executing this request via a cross-site forgery attack.

Recommendations Update YesWiki to version 4.6.6. As a temporary mitigation, restrict access to the BazarImportAction functionality or avoid using the importfiche parameter in the affected endpoint until the update is applied.