CVE-2026-104471YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import

Açıklama

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-v3gq-c7c6-mxw3) vendor-advisory
• VulnCheck Advisory: YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import third-party-advisory