CVE-2026-52777

critical · 9.4

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

9.4

CVSS

0.3%

EPSS (exploit prob.)

20th

EPSS percentile

2026-09-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-352CWE-502

References

https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-52777