YesWiki prior to version 4.6.7 allows authenticated administrators to upload arbitrary files through the Bazar CSV import preview function. An attacker can craft a CSV that contains a reference to a remote .php URL; the application downloads the file without validating its extension or content type and stores it in the web‑accessible files/ directory. Because the file is not subject to any sanitization, it can be executed as server‑side code, effectively giving the attacker remote code execution capabilities within the YesWiki environment.

The affected product is YesWiki (project name: yeswiki). Any deployment running a version before 4.6.7 is vulnerable. No specific sub‑versions are listed, so all releases earlier than 4.6.7 should be considered at risk.

The CVSS score is 8.6, indicating high severity. The EPSS score is not available, so the exploitation probability remains unknown, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires authenticated admin credentials to the web application; therefore, privileged access is necessary. Once logged in, an attacker can trigger the import to write a malicious script into the web‑accessible directory, where it will be executed upon request. The combination of unrestricted file upload and executable directory makes the impact potentially catastrophic for confidentiality, integrity, and availability of the affected system.