by Kastro
Paper/Archive/CVE-2026-52777

CVE-2026-52777

YesWiki yeswiki — YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

EPSS 0.3%CVSS 9.4
critical.is priorityof 100
32
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 20.1.201 × 204.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

Affected

ProductAffectedFixed inSource
yeswiki< 4.6.6–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2frefgithub.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0refgithub.com/YesWiki/yeswiki/releases/tag/v4.6.6