CVE-2026-52777

EUVD-2026-71808
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
9.4 CRITICAL
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 11.79%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
yeswikiyeswiki
𝑥
< 4.6.6
CNA
Common Weakness Enumeration
References
https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f