The vulnerability exists in YesWiki's tools/bazar/services/CSVManager.php in the importEntry method, which unserializes base64-decoded user input from the POST parameter 'importfiche' without restricting allowed classes. This leads to PHP object injection with magic method execution (notably __toString) on each array element. The import action is accessible only to authenticated wiki admins but lacks CSRF token verification, allowing remote exploitation via crafted POST requests that auto-execute upon admin session. The presence of doctrine/annotations and doctrine/cache dependencies with known PHPGGC gadget chains enables potential remote code execution. The vulnerability is reachable on default installs without additional configuration. No patch or official remediation is currently documented.

An attacker who can trick a wiki administrator into submitting a specially crafted POST request can achieve arbitrary PHP object injection, leading to remote code execution on the server hosting YesWiki. This is due to unsafe unserialize usage combined with exploitable gadget chains in bundled dependencies. The lack of CSRF protection on the import action facilitates remote exploitation despite admin-only access controls. Successful exploitation compromises the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the BazarImportAction to trusted administrators only and avoid exposing the import functionality to untrusted networks. Consider disabling or restricting the 'bazarimport' action if possible. Monitor for vendor updates addressing this vulnerability and apply official patches promptly once available.