YesWiki: Unrestricted file upload via Bazar CSV import
Summary
YesWiki before 4.6.7 lets an authenticated administrator import a CSV whose file or image field points to a remote URL. The server stores the downloaded file in the web-accessible files/ directory without extension checks. If PHP runs in that directory, as in the bundled nginx configuration, an attacker can execute code on the web server. The attack requires a valid admin account, and a public proof of concept is considered likely.
Affected
- YesWiki versions before 4.6.7 (the CNA data lists 0 to < 4.6.7; the vendor advisory lists <= 4.6.6)
- Composer package yeswiki/yeswiki
Fixed in
- Version 4.6.7 fixes this CVE (fix commit 07120ed8971047f504f7ec78060828f1895f475f)
- Version 4.7.0 or later also addresses the related CSV import SSRF CVE-2026-116827
Workaround
- No vendor workaround for this CVE is documented.
- Disable the Bazar CSV import if it is not required (inference from the related CVE-2026-116827, not a documented fix for this CVE).
- Limit admin accounts and enforce strong passwords and MFA where supported.
Exploitation
- Exploited in the wild: no evidence found.
- CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'.
- CISA KEV: not listed. EPSS: 0.00372.
Our recommendation
- Identify all YesWiki instances and their versions; anything before 4.6.7 is affected.
- Upgrade to 4.7.0 or the latest release.
- Until the upgrade, restrict admin accounts, disable Bazar CSV import if unused, and check the files/ directory for unexpected PHP files.
- Review recent Bazar CSV imports for remote URLs.
- Verify details against the GitHub advisory before rollout.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v3gq-c7c6-mxw3 github.com
- VulnCheck advisory: YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import www.vulncheck.com
- OSV entry CVE-2026-104471 osv.dev
- OpenCVE CVE-2026-104471 app.opencve.io
- OpenCVE CVE-2026-116827 (related CSV import SSRF) app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:24.
Original description (NVD)
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.