{"id":"CVE-2026-52777","title":"YesWiki is a wiki system written in PHP","summary":"YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.","severity":"critical","cvss":9.4,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","cwe":["CWE-352","CWE-502"],"vendor":"YesWiki","product":"yeswiki","affected":["yeswiki < 4.6.6"],"patched":["yeswiki/yeswiki 4.6.6"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:05:26.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52777","references":[{"url":"https://github.com/YesWiki/yeswiki/commit/8f70a8d6b8befa0e644d03c785701dbbc55b8fd0","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6","label":"security-advisories@github.com"},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-9369-69wj-7m2f","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-9369-69wj-7m2f"}],"tags":["nvd","cve.org","ghsa","composer"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-08T18:10:44.676857Z"},"cvssSource":"cna","epss":0.00215,"epssPercentile":0.1217,"aliases":["GHSA-9369-69wj-7m2f"],"ecosystem":"composer","ingestedAt":"2026-07-09T21:52:34.663Z","slug":"CVE-2026-52777","body":"## Overview\n\nYesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52777)\n\nAffected packages:\n\n- `yeswiki/yeswiki < 4.6.6`\n\nPatched in:\n\n- `yeswiki/yeswiki 4.6.6`\n\nSource: https://github.com/advisories/GHSA-9369-69wj-7m2f","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8188,"id":"CVE-2026-52777","ts":1788919973008,"field":"cvss","old":null,"new":"9.4"},{"seq":7997,"id":"CVE-2026-52777","ts":1788919275446,"field":"cvss","old":"9.4","new":null},{"seq":7806,"id":"CVE-2026-52777","ts":1788916333614,"field":"cvss","old":null,"new":"9.4"},{"seq":7615,"id":"CVE-2026-52777","ts":1788915291688,"field":"cvss","old":"9.4","new":null},{"seq":7424,"id":"CVE-2026-52777","ts":1788912694859,"field":"cvss","old":null,"new":"9.4"},{"seq":7233,"id":"CVE-2026-52777","ts":1788911323976,"field":"cvss","old":"9.4","new":null},{"seq":7040,"id":"CVE-2026-52777","ts":1788909060937,"field":"cvss","old":null,"new":"9.4"},{"seq":6852,"id":"CVE-2026-52777","ts":1788907385547,"field":"cvss","old":"9.4","new":null},{"seq":6654,"id":"CVE-2026-52777","ts":1788905428336,"field":"cvss","old":null,"new":"9.4"},{"seq":6472,"id":"CVE-2026-52777","ts":1788903454674,"field":"cvss","old":"9.4","new":null},{"seq":6267,"id":"CVE-2026-52777","ts":1788901797327,"field":"cvss","old":null,"new":"9.4"},{"seq":6097,"id":"CVE-2026-52777","ts":1788899558074,"field":"cvss","old":"9.4","new":null},{"seq":5908,"id":"CVE-2026-52777","ts":1788898149139,"field":"cvss","old":null,"new":"9.4"},{"seq":5797,"id":"CVE-2026-52777","ts":1788895705208,"field":"cvss","old":"9.4","new":null},{"seq":5750,"id":"CVE-2026-52777","ts":1788894572846,"field":"cvss","old":null,"new":"9.4"}]}