CVE-2026-52777

9.4 criticalEPSS 0.3%

Critical (9.4). EPSS 0.3% chance of exploitation in the next 30 days.

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWEs: CWE-352, CWE-502
Published: 2026-09-05
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0
https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f

Check your stack JSON