What’s Vulnerable › Vulnerabilities

CVE-2026-52777: YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

• Severity: critical (CVSS 9.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-05 · updated 2026-09-08
• Weakness: CWE-352

Description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

Affected products

• yeswiki: before 4.6.6

References

• https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0
• https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
• https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f

Get alerted when CVE-2026-52777 or the next vulnerability affects your stack