CVE-2026-104471

7.2 HIGHpublic exploit available

Published 2026-10-02 · Updated 2026-10-02

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-accessible files/ directory via Bazar CSV import preview. Attackers can import a CSV whose file or image field references a remote .php URL, which is saved without extension checks and executed as server-side code.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Public exploit & PoC references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v3gq-c7c6-mxw3
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v3gq-c7c6-mxw3

All references

https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v3gq-c7c6-mxw3
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unrestricted-file-upload-via-bazar-csv-import
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v3gq-c7c6-mxw3

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2023-54405PoC
HIGHCVE-2025-15700
HIGHCVE-2026-100389
MEDIUMCVE-2026-101071PoC
HIGHCVE-2026-102130PoC
MEDIUMCVE-2026-102137PoC
HIGHCVE-2026-102143PoC
MEDIUMCVE-2026-102263

Related by shared AI tags and CWE weakness class. Browse the full archive.