CVE-2026-52777Patch

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, there is an authenticated PHP object injection vulnerability in BazarImportAction via unserialize. This issue has been patched in version 4.6.6.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-352CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Bussio28Team | Ciberseguridad sin humo@Bussio28Team46d
Patch
⚠️ Ojo al dato si administráis algún YesWiki. Se acaba de publicar CVE-2026-52777, una vulnerabilidad crítica (9.4) que permite inyección de objetos PHP a un usuario autenticado mediante una llamada insegura a "unserialize()". 🔎 ¿Por qué importa? Una vulnerabilidad de este tipo puede acabar teniendo consecuencias bastante serias si consigue encadenarse con otros componentes de la aplicación. 🛡️ Qué haría ya: → Actualizar a YesWiki 4.6.6 o superior. → Revisar accesos y cuentas con permisos. → Comprobar logs por actividad anómala. No parece una vulnerabilidad para dejar en la lista de “ya actualizaré”. #Ciberseguridad #CyberSecurity
Post summary
The post announces CVE‑2026‑52777, explains its critical PHP object injection flaw, and emphasizes updating YesWiki to version 4.6.6 or newer to mitigate the risk.
10030136
1.6K followersView on X

Explore more

Back to dashboard