CVE-2026-52777

YesWiki, a PHP-based wiki/CMS platform, contains an authenticated PHP object injection vulnerability (CWE-502) in its BazarImportAction, where attacker-influenced data is passed to PHP's unserialize() without adequate validation. The flaw is also tagged as cross-site request forgery (CWE-352) and the CVSS 4.0 vector includes user interaction, indicating a logged-in user's session likely has to trigger the import request for exploitation to succeed. Successful object injection can, depending on the gadget chains available in YesWiki and its PHP dependencies, lead to high-impact outcomes such as arbitrary code execution, file manipulation, or disclosure of sensitive data, which is consistent with the 9.4 critical CVSS 4.0 score (high impact on confidentiality, integrity, and availability). Any YesWiki deployment running a version prior to 4.6.6 is affected, i.e., self-hosted wiki sites that have not yet applied the patch. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade YesWiki to version 4.6.6 or later as the primary fix. Until patched, restrict access to the Bazar import functionality to trusted authenticated users and review which accounts can reach BazarImportAction, and monitor for emerging proof-of-concept code given the critical severity rating.