CVE-2026-52777: 
PHP vulnerability analysis and mitigation

CVE-2026-52777 is a Critical-severity PHP Object Injection vulnerability in YesWiki's BazarImportAction component, combining unsafe deserialization (CWE-502) with a missing CSRF token check (CWE-352). It affects all versions of yeswiki/yeswiki prior to 4.6.6 and was first published on June 2, 2026, with the GitHub Advisory Database entry updated on July 9, 2026. The vulnerability carries a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory).

The root cause is a call to unserialize(base64_decode($entry)) in tools/bazar/services/CSVManager.php (lines 372–399) without the ['allowed_classes' => false] restriction, allowing arbitrary PHP class instantiation from attacker-controlled POST data ($_POST['importfiche']). The subsequent array_map('strval', $entry) call additionally triggers __toString magic methods on deserialized objects, expanding the gadget-chain surface. The importentries code path in BazarImportAction.php lacks any CSRF token validation — unlike sibling actions such as FormController.php — meaning a remote attacker can trigger the sink by tricking an authenticated admin into visiting a malicious page that auto-POSTs to /?BazaR&vue=importer&id_typeannonce=1. YesWiki's composer.json requires doctrine/annotations ^1.11 and doctrine/cache ^1.10, both of which have published PHPGGC gadget chains (e.g., Doctrine/RCE1, Doctrine/FW1) enabling system() or file_put_contents() execution (GitHub Advisory, YesWiki Advisory).

Successful exploitation grants the attacker remote code execution on the YesWiki server host, effectively escalating from wiki admin privileges to an OS-level shell. The attacker can write web shells, dump the MySQL database, modify wakka.config.php, exfiltrate data from other sites on shared hosting, and pivot laterally within the hosting environment. All three security pillars — confidentiality, integrity, and availability — are fully compromised on both the vulnerable system and any subsequent systems reachable from it (GitHub Advisory).

A self-contained proof-of-concept (PoC) is publicly available that demonstrates attacker-controlled __destruct execution within the unmodified importEntry code path, confirmed by the advisory author (fg0x0). The PoC payload (YToxOntpOjA7Tzo2OiJHYWRnZXQiOjE6e3M6NjoibWFya2VyIjtzOjIyOiJQV05FRC1GUk9NLVVOU0VSSUFMSVpFIjt9fQ==) can be substituted with a real PHPGGC Doctrine chain for full RCE. The EPSS score is 0.379% (60th percentile), and no in-the-wild exploitation or CISA KEV listing has been reported as of the advisory date. No threat actor attribution is currently available (GitHub Advisory).

1. Reconnaissance: Identify a YesWiki instance running a version prior to 4.6.6 (e.g., via HTTP response headers, page footers, or Shodan/Censys searches for YesWiki-specific paths like /?BazaR).
2. Identify an admin user: Enumerate or social-engineer a wiki administrator account. The BazarImportAction requires admin-level session privileges (checkSecuredACL() with $adminOnly=true).
3. Generate a PHPGGC gadget chain payload: Use the public PHPGGC tool to generate a serialized PHP object chain targeting Doctrine dependencies bundled with YesWiki (e.g., php phpggc Doctrine/RCE1 system 'id' -b for base64-encoded output).
4. Craft a CSRF attack page: Create an HTML page with an auto-submitting form that POSTs the gadget chain payload to the target:

<form method="POST" action="https://wiki.example.com/?BazaR&vue=importer&id_typeannonce=1">
  <input name="importfiche[0]" value="<PHPGGC_BASE64_PAYLOAD>">
</form>
<script>document.forms[0].submit();</script>

5. Deliver the CSRF page: Send the malicious URL or HTML page to the admin via email, chat, or any social engineering vector. When the admin's browser loads the page while authenticated, their session cookie is automatically included in the POST request.
6. Trigger deserialization: The server receives the POST, sets mode to importentries, and calls CSVManager::importEntry(), which executes unserialize(base64_decode($entry)) on the attacker-controlled payload — instantiating the gadget chain and triggering RCE.
7. Achieve shell access: Depending on the gadget chain used, the attacker obtains command execution (e.g., via system()) or writes a PHP web shell to the server via file_put_contents() (GitHub Advisory, YesWiki Advisory).

• Network: Unexpected HTTP POST requests to /?BazaR&vue=importer&id_typeannonce= originating from unusual referrers or external origins; outbound connections from the web server process to attacker-controlled IPs following such requests.
• Logs: Web server access logs showing POST requests to the BazaR importer endpoint (?BazaR&vue=importer) with a importfiche[] parameter containing long base64-encoded strings; PHP error logs showing unserialize() warnings or TypeError exceptions related to object-to-string conversion in CSVManager.php.
• File System: Newly created PHP files in the YesWiki web root or upload directories (potential web shells); unexpected modifications to wakka.config.php; new or modified files in tools/bazar/ directories.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker (e.g., sh, bash, curl, wget, python) with the web server user as the parent; unexpected cron jobs added under the web server user account.

Upgrade yeswiki/yeswiki to version 4.6.6 or later, which applies two fixes: (1) passes ['allowed_classes' => false] to unserialize() in CSVManager.php to block arbitrary class instantiation, and (2) adds a CsrfTokenController::checkToken() guard to the importentries branch in BazarImportAction.php. The patch is available in commit 8f70a8d (Fix Commit). As a temporary workaround if upgrading is not immediately possible, restrict access to the BazaR importer page at the web server or network level, or remove admin accounts that are not strictly necessary to reduce the CSRF attack surface (GitHub Advisory).

The vulnerability was reported by security researcher fg0x0 and published by YesWiki maintainer mrflos on June 2, 2026, with the fix committed the same day. The advisory notes this is a novel vulnerability class for the YesWiki project, as prior advisories covered XSS, SQLi, path traversal, and unauthenticated backup download — but no prior PHP object injection sink. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory itself (YesWiki Advisory).