External risk intelligence

YesWiki PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-52777

YesWiki is a web-based application typically deployed as an internet-facing wiki or collaborative platform. As a web application, it is designed to be accessible via standard web browsers, making its web interface and associated actions common targets for public internet exposure in typical deployments.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the YesWiki system that could allow an authenticated user to inject PHP objects through its BazarImportAction feature. This impacts versions prior to 4.6.6, with a patch available in version 4.6.6. The primary concern is confirming if our YesWiki instances are affected and require updating.

Authenticated users can inject malicious code.
Web applications require regular security updates.
Confirm YesWiki exposure and apply available patches.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by interacting with the wiki system, potentially through a crafted request. This could allow an attacker to inject malicious PHP objects, leading to further compromise of the system. The specific entry point involves the BazarImportAction feature.

Requires user interaction.
Triggered by BazarImportAction.
Leads to code injection.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject and execute arbitrary PHP code within the wiki system. This could occur when an authenticated user interacts with specific imported Bazar data, potentially leading to unauthorized access to or modification of system data and user information.

System and user data could be compromised.
Unauthenticated code execution via Bazar import.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

YesWiki administrators and the platform team are likely responsible for this wiki system. The first practical step is to identify all YesWiki instances, confirm their reachability and business criticality, and then locate the accountable owner for remediation planning.

Platform owners should manage this issue.
Verify YesWiki instance reachability and criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is YesWiki?

YesWiki is a collaborative, web-based platform built on PHP that organizations use to manage documentation and create shared wikis. Because it functions as a dynamic web application, it handles various user-submitted data types and interactions, which is the context for the BazarImportAction feature that manages data imports.

What is the vulnerability in CVE-2026-52777?

This CVE involves PHP object injection, categorized as CWE-502. In simple terms, the software incorrectly processes serialized data during the import process. By providing specially crafted input, an attacker can trick the application into instantiating unintended PHP objects, which may allow them to execute arbitrary code on the server.

How is this vulnerability triggered?

The issue is triggered through the BazarImportAction feature when it processes input using the PHP unserialize function. It is important to note that this is not a general flaw in the entire site; features unrelated to Bazar imports do not trigger this specific object injection, and the flaw requires the attacker to be authenticated to the system.

Is my YesWiki instance at risk?

If you run an older version of YesWiki, you should consider it potentially reachable. According to Halo Surface Signal, YesWiki is typically deployed as an internet-facing service to facilitate collaboration. If your instance is accessible from the public internet, the attack surface is wider compared to an internal, restricted-access wiki.

Do I need to update my software?

Yes, updating is the primary way to resolve this. Your first step is to identify all YesWiki installations in your environment and determine their current version. If you are running any version prior to 4.6.6, you should plan to update to 4.6.6 or later, as this release contains the necessary patch to safely handle imported data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.