CVE-2026-104471: YesWiki RCE Vulnerability

CVE-2026-104471 Overview

CVE-2026-104471 is an unrestricted file upload vulnerability [CWE-434] in YesWiki versions before 4.6.7. The flaw resides in the Bazar CSV import preview feature. Authenticated administrators can submit a CSV whose file or image field references a remote .php URL. YesWiki fetches the remote file and writes it into the web-accessible files/ directory without validating the extension. The attacker then requests the uploaded script to achieve remote code execution on the server.

Critical Impact
Authenticated administrators can write arbitrary PHP files into a web-accessible directory via Bazar CSV import, leading to server-side code execution and full application compromise.

Affected Products

YesWiki versions prior to 4.6.7
YesWiki Bazar extension (CSV import preview functionality)
Web servers hosting vulnerable YesWiki installations with PHP execution enabled in the files/ directory

Discovery Timeline

2026-10-02 - CVE-2026-104471 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104471

Vulnerability Analysis

YesWiki is an open-source collaborative wiki written in PHP. The Bazar extension provides a CSV import feature that lets administrators bulk-create entries. During the import preview stage, YesWiki parses CSV rows and processes fields typed as file or image. When one of these fields contains a URL, the application retrieves the remote resource and persists it to the files/ directory.

The import routine does not validate the file extension, MIME type, or content against an allowlist. An attacker-controlled CSV can therefore reference a remote .php payload. YesWiki writes the fetched file verbatim under the web root, where the PHP interpreter executes it on the next HTTP request.

Root Cause

The root cause is missing input validation on remote resource references in the Bazar CSV importer. The server retrieves attacker-supplied URLs and writes the response body to disk without enforcing an extension allowlist, content-type check, or path containment on the destination. This matches [CWE-434: Unrestricted Upload of File with Dangerous Type].

Attack Vector

Exploitation requires administrator credentials but no user interaction, and the vector is network-based. An authenticated administrator submits a crafted CSV through the Bazar import preview. The CSV references a remote .php file in a file or image column. YesWiki downloads the payload into files/, where it becomes directly reachable through the web server. The attacker then requests the uploaded script to execute arbitrary PHP code in the application context.

No verified proof-of-concept code has been released. Technical details are described in the GitHub Security Advisory and the VulnCheck Advisory on YesWiki.

Detection Methods for CVE-2026-104471

Indicators of Compromise

Presence of .php, .phtml, or other executable scripts in the YesWiki files/ directory that were not placed there by administrators
Outbound HTTP requests from the YesWiki host to unexpected URLs during CSV import operations
Access log entries showing direct GET requests to newly created files under /files/ shortly after a Bazar CSV import
Bazar CSV import records referencing remote URLs in file or image columns

Detection Strategies

Audit the files/ directory for files whose extensions do not match the expected image or document types used in Bazar entries
Correlate web server access logs with YesWiki application logs to identify CSV imports followed by requests to attacker-controlled filenames
Review Bazar entries for file or image field values that contain external URLs rather than locally uploaded assets

Monitoring Recommendations

Alert on any write of a .php file into web-accessible directories on hosts running YesWiki
Monitor administrator session activity for Bazar CSV import actions and record the submitted CSV content
Track outbound connections from the PHP worker process to unapproved external hosts

How to Mitigate CVE-2026-104471

Immediate Actions Required

Upgrade YesWiki to version 4.6.7 or later, which addresses the unrestricted file upload in the Bazar CSV importer
Review and rotate administrator credentials, since exploitation requires an authenticated admin account
Inspect the files/ directory and remove any unauthorized executable scripts; investigate the host for signs of post-exploitation activity

Patch Information

The YesWiki project released version 4.6.7 to remediate CVE-2026-104471. Refer to the GitHub Security Advisory GHSA-v3gq-c7c6-mxw3 for the fix commit and upgrade instructions. Administrators should apply the update across all YesWiki instances before resuming Bazar CSV import workflows.

Workarounds

Temporarily disable the Bazar CSV import preview feature until the patch is applied
Restrict administrator accounts to trusted personnel and enforce multi-factor authentication on administrative logins
Configure the web server to deny PHP execution within the YesWiki files/ directory using directives such as php_flag engine off or an equivalent location block
Deploy a web application firewall rule that blocks CSV uploads containing remote URL references in file or image columns

bash

# Configuration example: disable PHP execution under files/ in Apache
<Directory "/var/www/yeswiki/files">
    php_flag engine off
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>