CVE-2026-52777: YesWiki Vulnerable to Authenticated PHP Object Injection in BazarImportAction via unserialize

July 9, 2026

Authenticated wiki admin who lands on attacker-controlled HTML obtains remote code execution on the YesWiki server (via the cross-site forgery path; no admin interaction with the import UI is required).
An attacker who has already compromised an admin password upgrades from “wiki content management” to “OS shell on the hosting box”.
The compromise survives the wiki layer entirely: the attacker can write web shells, exfiltrate other sites on shared hosting, modify wakka.config.php, dump the MySQL database, and pivot from there.

References

github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0
github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f
github.com/advisories/GHSA-9369-69wj-7m2f
nvd.nist.gov/vuln/detail/CVE-2026-52777

Code Behaviors & Features

Detect and mitigate CVE-2026-52777 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →