Unrated

Authenticated PHP Object Injection in YesWiki BazarImportAction

IdentifiersCVE-2026-52777CWE-502

CVE-2026-52777 is an authenticated PHP object injection vulnerability in YesWiki affecting the Bazar import workflow. The issue stems from unsafe deserialization of attacker-controlled input in BazarImportAction, where serialized PHP data is accepted and passed to unserialize without adequate restrictions. Because the import path also lacks effective CSRF protection, an attacker can induce a privileged user to submit a crafted import request, allowing attacker-supplied serialized objects to be processed by the server. If a suitable gadget chain is present in the application or its dependencies, successful exploitation can result in remote code execution on the YesWiki host.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to remote code execution in the context of the YesWiki application and underlying web server account. This may enable deployment of web shells, execution of arbitrary operating system commands, theft of application configuration and database contents, compromise of co-hosted applications in shared environments, and follow-on lateral movement within the affected infrastructure. Because the vulnerable path can be reached through CSRF against an authenticated administrator, exploitation may not require direct possession of valid admin credentials if an administrator can be induced to submit the malicious request.

Mitigation

If you can’t patch tonight, do this now.

Until patches are fully deployed, restrict or disable access to the Bazar import feature, including the bazarimport action and related importer functionality. Reduce exposure of administrative sessions to untrusted content to lower CSRF risk, and implement compensating CSRF protections in front of the vulnerable workflow where feasible. Prevent unsafe object deserialization by removing or blocking the serialized-PHP import path, or by enforcing deserialization settings that disallow object creation. Monitor for suspicious POST activity targeting the importer workflow and investigate signs of unexpected command execution or administrative import operations.

Remediation

Patch, then assume compromise.

Upgrade YesWiki to version 4.6.6 or later. Replace the legacy serialized PHP transport used by the import mechanism with a safer format such as JSON wherever possible. If deserialization cannot be removed immediately, harden the code by invoking unserialize with class instantiation disabled, such as allowed_classes=false, to prevent object injection. Add CSRF validation to the importentries mode and other state-changing request paths so that crafted cross-site requests cannot be used to reach the vulnerable functionality.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

YeswikiYeswikiapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1