CVE-2026-104471: YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
YesWikito a version that resolves this vulnerability.Fixed in 4.6.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated YesWiki administrator can exploit it. The attack path uses the Bazar CSV import preview and requires the attacker to control a CSV file or image field that references a remote PHP URL.
Are default deployments affected?
The available information identifies affected versions as YesWiki releases before 4.6.7. It does not state whether Bazar CSV import is enabled or reachable in a default installation.
What is the impact of successful exploitation?
The remote PHP content can be saved into the web-accessible files/ directory without extension checks and then executed as server-side code. This can result in high-impact compromise of confidentiality, integrity, and availability.
How can I check for possible exploitation?
Review the web-accessible files/ directory for unexpected PHP files, particularly files that may have been created through Bazar CSV import activity. Also review administrator CSV import records for file or image fields containing remote PHP URLs.