CVE-2026-104471YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

Beschreibung

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-v3gq-c7c6-mxw3) vendor-advisory
• VulnCheck Advisory: YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import third-party-advisory