CVE-2026-52777: YesWiki PHP Object Injection Vulnerability

CVE-2026-52777 Overview

YesWiki is an open-source wiki system written in PHP. Versions prior to 4.6.6 contain an authenticated PHP object injection vulnerability in the BazarImportAction component. The flaw stems from unsafe use of unserialize() on attacker-controlled data during the Bazar import workflow. An authenticated user who can trigger a bazar import can supply a crafted serialized payload, causing PHP to instantiate arbitrary classes and invoke magic methods. The issue is patched in YesWiki 4.6.6, which restricts deserialization to primitive types only.

Critical Impact
Authenticated attackers can trigger PHP object injection via unserialize() in BazarImportAction, enabling arbitrary object instantiation and potential remote code execution through gadget chains.

Affected Products

YesWiki versions prior to 4.6.6
YesWiki tools/bazar/actions/BazarImportAction.php component
YesWiki tools/bazar/services/CSVManager.php service

Discovery Timeline

2026-09-05 - CVE CVE-2026-52777 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-52777

Vulnerability Analysis

The vulnerability resides in YesWiki's Bazar import functionality, which processes CSV-based entry imports. During import, each entry is base64-decoded and passed to PHP's unserialize() function without class restrictions. PHP object injection [CWE-502] allows an attacker to instantiate arbitrary classes present in the application. When combined with gadget chains available in YesWiki dependencies, attackers can escalate the flaw to file writes, deletions, or remote code execution. The advisory GHSA-9369-69wj-7m2f also notes CSRF-related exposure [CWE-352], meaning the import action can potentially be triggered against an authenticated victim via cross-site request forgery.

Root Cause

The root cause is the unrestricted use of unserialize(base64_decode($entry)) inside CSVManager::importEntries(). PHP deserialization on untrusted input is a well-known dangerous pattern. Without the allowed_classes option, PHP will materialize any class definition available in the application, triggering __wakeup(), __destruct(), and other magic methods on attacker-controlled objects.

Attack Vector

An authenticated user with access to the Bazar import feature crafts a base64-encoded serialized PHP object referencing a known gadget class. The payload is submitted through the import endpoint handled by BazarImportAction. When CSVManager processes the entry, PHP deserializes the payload and invokes lifecycle methods on the instantiated object. If a suitable gadget chain exists in loaded code, the chain leads to file system operations or command execution in the web server context.

php

// Patch: tools/bazar/services/CSVManager.php
$GLOBALS['_BAZAR_']['provenance'] = 'import';
$createdEntries = [];
foreach ($importedEntries as $entry) {
-    $entry = unserialize(base64_decode($entry));
+    $entry = unserialize(base64_decode($entry), ['allowed_classes' => false]);
    $entry = array_map('strval', $entry);

    $entry['antispam'] = 1;

Source: YesWiki commit 8f70a8d

The patch adds the ['allowed_classes' => false] option, forcing PHP to decode objects as __PHP_Incomplete_Class stubs rather than instantiating real classes. A companion change in BazarImportAction.php introduces the CsrfTokenController to validate request origin.

php

// Patch: tools/bazar/actions/BazarImportAction.php
use YesWiki\Bazar\Service\CSVManager;
use YesWiki\Bazar\Service\ExternalBazarService;
use YesWiki\Bazar\Service\FormManager;
+use YesWiki\Core\Controller\CsrfTokenController;
use YesWiki\Core\YesWikiAction;

class BazarImportAction extends YesWikiAction

Source: YesWiki commit 8f70a8d

Detection Methods for CVE-2026-52777

Indicators of Compromise

Unexpected HTTP POST requests to Bazar import endpoints invoking BazarImportAction from authenticated sessions.
Base64-encoded payloads in import requests that decode to serialized PHP objects starting with O: or a: structures.
New or modified PHP files, cron entries, or web shells appearing on the YesWiki host after an import event.
PHP error logs referencing __wakeup, __destruct, or class instantiation failures during import processing.

Detection Strategies

Inspect web server access logs for requests to the Bazar import action and correlate against the authenticated user account performing them.
Monitor PHP-FPM or Apache logs for deserialization warnings, unexpected class autoload failures, or fatal errors originating in CSVManager.php.
Deploy web application firewall rules that flag base64 blobs decoding to PHP serialized object markers on import endpoints.

Monitoring Recommendations

Alert on any successful invocation of BazarImportAction outside of change-managed maintenance windows.
Track file integrity of the YesWiki webroot to detect post-exploitation file drops or modifications.
Correlate import activity with outbound network connections from the web server to identify reverse shells or data exfiltration.

How to Mitigate CVE-2026-52777

Immediate Actions Required

Upgrade YesWiki to version 4.6.6 or later, which restricts deserialization with ['allowed_classes' => false] and adds CSRF token validation to the import action.
Audit user accounts with permission to trigger Bazar imports and revoke access from any account that does not require it.
Review web server logs for prior invocations of the import endpoint and investigate any suspicious payloads.

Patch Information

The fix is available in the YesWiki 4.6.6 release. Technical details of the change are documented in GitHub Security Advisory GHSA-9369-69wj-7m2f and the remediation commit 8f70a8d.

Workarounds

If immediate upgrade is not possible, restrict access to the Bazar import feature at the web server or reverse proxy layer to trusted administrators only.
Enforce strict Content Security Policy and same-site cookie attributes to reduce the CSRF exposure surface of the import endpoint.
Place the YesWiki instance behind a WAF configured to block requests containing base64-encoded PHP serialized object markers.

bash

# Example nginx restriction limiting Bazar import to a trusted admin IP
location ~ /\?.*action=bazarimport {
    allow 203.0.113.10;
    deny all;
}