CVE-2026-104441 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to an unauthenticated server-side request forgery vulnerability that stems from improper validation of user-supplied input within the rendering engine. The core technical flaw resides in how the application processes the url parameter associated with the valeur action. When a remote attacker submits content through the page/render.php handler, specifically via the content parameter, they can inject malicious URLs into this parameter without any form of authentication or access control checks. This lack of input sanitization allows the server to initiate HTTP requests to arbitrary hosts and ports specified by the attacker, effectively turning the vulnerable application into a proxy for network reconnaissance and data exfiltration from internal resources that would otherwise be inaccessible from the public internet.
The operational impact of this vulnerability is significant as it enables remote attackers to probe internal HTTP services and read back response content that matches specific markup patterns defined in YesWiki's fiche system. By leveraging this server-side request forgery, an attacker can map out the internal network topology, identify running services on non-standard ports, and potentially extract sensitive data from internal APIs or administrative interfaces that do not require authentication themselves. The ability to read back response content means that even if a target service does not return full page structures, any text matching the expected markup format will be reflected in the application's output, providing a reliable channel for out-of-band data retrieval and further exploitation of adjacent systems within the trusted network perimeter.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where a web server retrieves a specified resource from a user-supplied URL without validating whether that request should be permitted to originate from the server itself. Additionally, the exploitation technique maps directly to MITRE ATT&CK tactic T1571, specifically the sub-technique of Non-Standard Ports, as attackers can target services running on ports other than standard HTTP or HTTPS defaults to bypass basic network security controls and firewalls that might only inspect traffic on common service ports. The unauthenticated nature of this exploit further exacerbates the risk by removing any prerequisite for attacker identity verification, allowing immediate exploitation upon discovery.
Mitigation strategies should prioritize upgrading YesWiki to version 4.6.7 or later where these input validation mechanisms have been addressed. In environments where an upgrade is not immediately feasible, administrators can implement network-level controls such as web application firewalls that inspect outbound HTTP requests for suspicious patterns or unauthorized destination IPs. It is also advisable to restrict the server's ability to make external connections by configuring strict egress firewall rules and disabling unnecessary PHP functions like curl or file_get_contents if they are not required for core functionality. Additionally, implementing input validation on all user-supplied parameters that influence network behavior can provide a defense-in-depth layer against SSRF attempts until permanent patches are applied.