This vulnerability is an authenticated PHP object injection flaw in the BazarImportAction endpoint of the YesWiki wiki system. A logged‑in user can submit a serialized payload that is processed by PHP's unserialize function. Because the application deserializes data that can be crafted by the attacker, arbitrary objects can be instantiated, leading to remote code execution or data modification. The weakness involves processing untrusted serialized data (CWE-502) and classifies under CSRF (CWE-352) per the advisory, though no explicit cross‑site request forgery mechanism was described.

The flaw affects deployments of YesWiki prior to version 4.6.6. Any site running an unpatched older release, especially those exposing the BazarImportAction route, is vulnerable.

The CVSS score of 9.4 marks it as critical. The EPSS score is not available, so the precise exploitation likelihood is unknown, and it is not listed in the CISA KEV catalog. The attack requires authenticated access; an attacker must obtain valid Wiki credentials to inject the malicious payload. Once authenticated, the crafted data can trigger arbitrary code execution or unauthorized modification of content.