Summary
YesWiki contains an unrestricted file upload vulnerability in the Bazar CSV import preview workflow. An authenticated administrator may cause a remote PHP file referenced by a CSV field to be saved in the web-accessible files/ directory, where it could be interpreted as server-side code.
Affected context
The vulnerability occurs in YesWiki deployments that enable the Bazar CSV import preview feature and allow authenticated administrators to submit or process CSV data containing file or image references. Risk is increased when referenced files are saved into a web-accessible directory without validating their extensions, content type, or execution behavior.
Exploit preconditions
- Attack surface: Bazar CSV import preview and its file or image handling logic
- Required access: Authenticated administrative access, or another account with permission to initiate the import workflow
- Trigger point: Processing a CSV field that references a remote file
- Why exploitation is possible: The referenced file may be written to a web-accessible directory without adequate extension and content validation, allowing server-side script interpretation
Why this happens
The underlying bug is an insufficiently constrained file upload and storage process. Remote file references supplied through an administrative import workflow are trusted and persisted without reliably restricting file types, validating content, or ensuring that stored files cannot be executed.
This maps to CWE-434: Unrestricted Upload of File with Dangerous Type, where an application permits a potentially executable file to be uploaded or written to a location where it may later be processed by the server.
Potential impact
- An attacker may execute server-side code with the permissions of the web application
- The application or host could be modified, disrupted, or used to access stored data
- Web-accessible files may be replaced or used to support persistent compromise
- The server could become a starting point for further internal access, depending on its privileges
General mitigation guidance
Mitigation generally focuses on reducing trust in imported file references and ensuring that uploaded content cannot be executed.
Common defensive patterns include:
- Allowing only explicitly approved file types based on content and business need
- Validating file names, extensions, MIME types, and file signatures independently
- Restricting remote fetch behavior to approved sources or disabling it when unnecessary
- Storing user-controlled files outside the web root, or serving them through a non-executable content handler
- Generating server-controlled names and preventing path manipulation
- Applying strict size, type, and resource limits to imports
- Running the application with least privilege and separating uploaded content from executable application code
How teams detect issues like this
Detection can combine static analysis, code review, runtime monitoring, and policy enforcement.
Useful signals include:
- Static analysis findings for file writes that use user-controlled names, URLs, or extensions
- Review of import handlers for remote downloads, MIME checks, and storage-directory selection
- Monitoring for newly created executable-looking files in web-accessible directories
- Web-server alerts for requests to recently created files or unusual script extensions
- CI policies requiring approved upload validation and non-executable storage locations
- Automated code review tools that flag unrestricted upload and remote file retrieval patterns
