YesWiki versions 1 and 2 suffers from remote arbitrary file upload and directory traversal vulnerabilities.