CVE-2026-104471 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to an unrestricted file upload vulnerability that stems from insufficient validation of user-supplied input during the CSV import preview functionality within the Bazar module. This flaw specifically affects authenticated administrators, allowing them to write arbitrary remote files into the web-accessible files/ directory. The attack vector involves importing a crafted CSV file where one of the fields designated for file or image uploads contains a URL pointing to a malicious PHP script hosted on an external server. Because the application fails to perform adequate extension checks or content validation when processing these references, it proceeds to download and save the remote resource directly into the target directory without sanitizing the filename or verifying its integrity.
The technical core of this vulnerability lies in the lack of strict file type enforcement during the import process. When an administrator initiates a CSV preview with a field referencing a remote PHP URL, the system retrieves the content from that external source and stores it locally. Crucially, the application does not append or enforce a safe extension such as .txt or .csv to prevent execution. Instead, if the remote resource is named with a server-side script extension like .php, or if the system preserves the original filename without modification, the file becomes executable by the web server. This behavior effectively bypasses standard security controls that rely on file extensions to determine how content should be handled by the application and the underlying operating system.
The operational impact of this vulnerability is severe, as it leads directly to remote code execution (RCE) on the affected server. Once the malicious PHP script is uploaded to a web-accessible directory, an attacker can trigger its execution simply by accessing the file via HTTP request. This allows for complete compromise of the underlying system, enabling actions such as data exfiltration, installation of backdoors, pivoting to other internal systems, or defacement of the website. Since authentication is required, this vulnerability poses a significant risk in environments where administrative credentials may be compromised through phishing, credential stuffing, or other means. The ability to execute arbitrary code transforms what might otherwise be an information disclosure issue into a critical infrastructure compromise.
This flaw aligns with CWE-434, which describes the unrestricted upload of files with dangerous types, and is further contextualized by MITRE ATT&CK technique T1505.003, known as Server Side Request Forgery (SSRF) via file inclusion or upload mechanisms that facilitate initial access. To mitigate this risk, administrators should immediately upgrade to YesWiki version 4.6.7 or later, where the issue has been addressed through stricter input validation and extension filtering. In addition to upgrading, organizations should implement defense-in-depth strategies such as configuring web servers to disable script execution in upload directories using directives like Options -ExecCGI for Apache or deny rules for IIS. Regular auditing of uploaded files and restricting administrative access via multi-factor authentication can further reduce the attack surface associated with this vulnerability.