YesWiki CVE-2026-104471

Exploitation requires an authenticated YesWiki administrator account (PR:H) and specifically the use of the Bazar extension's CSV import preview feature, where a CSV file/image field references a remote .php URL. The vulnerable behavior is that the referenced remote file is fetched and written into the web-accessible files/ directory with no extension/MIME validation, then served and executed by the PHP engine. Limiting factors: the attacker must already possess admin privileges and the target must run an affected YesWiki version (before 4.6.7) with the Bazar component in use; no end-user interaction is required beyond the attacker's own admin actions. This is therefore effectively a privilege-escalation-to-RCE flaw rather than an unauthenticated remote compromise.

This is a genuine remote code execution flaw (CWE-434 unrestricted file upload) but one gated behind meaningful privilege, which substantially tempers real-world risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC/VI/VA all High) correctly reflects that an attacker needs HIGH privileges - specifically authenticated administrator access - to reach the vulnerable Bazar CSV import preview, while impact on the vulnerable system is total (full confidentiality, integrity, and availability). No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active exploitation or public exploit code. The SSVC-style read is: technical impact is total and the attack is network-reachable with low complexity, but the PR:H requirement means it is NOT trivially automatable against arbitrary targets - an attacker must already hold admin credentials. The practical consequence is privilege escalation from application admin to server-side code execution, which matters most as a post-compromise or insider/credential-theft vector rather than a mass-exploitation threat. Net: a real priority for YesWiki operators to patch, but its effective severity is lower than the 8.6 headline implies because of the admin prerequisite.

An attacker who has obtained YesWiki administrator credentials (via phishing, credential reuse, or a compromised admin account) crafts a malicious CSV for Bazar import whose file/image field references a remote URL ending in .php. During CSV import preview the application fetches and saves that file into the web-accessible files/ directory without extension validation, and the attacker then requests the saved PHP file to execute arbitrary server-side code. No public exploit code is identified in the provided data.