CVE-2026-104471 — YesWiki before 4.6.7 Unrestricted File Upload via Bazar CSV Import
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar…
Published: 2026-10-02 · CVSS: 8.6 · CVSS 4.0
YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7