CVE-2026-104442 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a critical unauthenticated server-side request forgery vulnerability that stems from improper validation of user-supplied input within the application's syndication processing logic. The flaw is specifically located in the render handler, where the content parameter accepts values intended for feed rendering without sufficient sanitization or restriction on the protocols and destinations allowed. This architectural oversight enables remote attackers to manipulate the server into initiating HTTP requests to arbitrary Uniform Resource Locators. By injecting malicious payloads through this specific entry point, an attacker can bypass authentication mechanisms entirely, as no valid session credentials are required to trigger the vulnerable code path.
The operational impact of this vulnerability is significant due to its potential for internal network reconnaissance and data exfiltration. Attackers can leverage the server's outbound connectivity to target internal hosts and ports that may not be directly accessible from the external internet. This capability effectively turns the YesWiki instance into a proxy or pivot point, allowing adversaries to map internal network topologies, identify running services on private IP addresses, and probe for other vulnerabilities within the local infrastructure. The ability to specify arbitrary URLs means that attackers are not limited to standard web ports; they can attempt connections to database servers, management interfaces, or IoT devices residing behind firewalls that would otherwise remain protected from direct external access attempts.
Furthermore, the vulnerability facilitates data leakage through two primary mechanisms: reading back fetched feed content and downloading enclosures. When the server fetches a URL provided by the attacker, the resulting response is often rendered directly into the page output visible to subsequent users or potentially logged in ways that expose sensitive information. This allows attackers to retrieve internal documents, configuration files, or error messages from targeted services. Additionally, the application's tendency to download feed enclosures into the local files directory creates a risk of storing malicious artifacts on the server itself. These downloaded files could include executable scripts, phishing pages, or other payloads that might be executed later if the web server is misconfigured to allow script execution within upload directories, thereby escalating the threat from information disclosure to potential remote code execution.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes flaws where an application fetches a remote resource without validating the user-supplied URL. The attack vector also corresponds to MITRE ATT&CK technique T1571, Non-Standard Port Communication, as attackers may use non-standard ports to evade detection by standard web application firewalls that typically monitor traffic on port 80 or 443. Additionally, the ability to read back fetched content relates to CWE-209 Generation of Error Message Containing Sensitive Information if internal error details are exposed in the rendered output.
Mitigation strategies must prioritize immediate patching and input validation updates. Administrators should upgrade YesWiki to version 4.6.7 or later, where this specific flaw has been addressed through stricter URL parsing and protocol whitelisting. In environments where upgrading is not immediately feasible, network-level controls such as egress filtering can be implemented to restrict the web server's outbound connections to only known trusted destinations. This includes blocking access to private IP address ranges like 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x at the firewall level. Furthermore, configuring web servers to prevent script execution in upload directories adds a layer of defense against potential secondary exploitation via downloaded enclosures. Regular security audits focusing on input validation for all parameters passed to rendering handlers are essential to prevent similar SSRF vulnerabilities from being introduced through other features or future updates.