CVE-2026-104470 in YesWiki
Summary
by MITRE • 10/02/2026
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
YesWiki versions prior to 4.6.7 are susceptible to a critical Server-Side Request Forgery vulnerability located within the Bazar valeur action module. This flaw arises from insufficient validation of user-supplied input passed through the url parameter, allowing authenticated page editors to manipulate the server into initiating HTTP requests to arbitrary destinations. The core technical deficiency lies in the application's failure to restrict or sanitize the target URLs provided by the user, thereby granting an attacker control over the outbound network connections initiated by the backend process. This lack of proper input validation creates a direct pathway for attackers to exploit the trust relationship between the web server and internal infrastructure services that are not directly accessible from external networks.
The operational impact of this vulnerability is multifaceted, primarily enabling unauthorized reconnaissance of the internal network architecture. By supplying loopback addresses or private IP ranges in the url parameter, an attacker can probe internal services such as databases, administrative panels, or other microservices running on localhost or within the local subnet. This capability effectively bypasses perimeter security controls like firewalls that typically block external access to these sensitive resources. The vulnerability allows for detailed mapping of the internal environment, potentially revealing service versions, open ports, and configuration details that can be leveraged in subsequent attack phases.
Beyond network reconnaissance, this flaw facilitates a more severe client-side impact through Remote Code Execution via Cross-Site Scripting. Because the server fetches arbitrary URLs without proper sanitization or encoding of the response content before rendering it to end-users, attackers can inject unescaped remote HTML and JavaScript code into the page context. When other users view these compromised pages, their browsers execute the injected scripts in the security context of the YesWiki domain. This leads to session hijacking, credential theft, defacement, or further propagation within the application environment, significantly compromising the confidentiality and integrity of user data and system operations.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), which describes weaknesses in server-side input validation that allow attackers to induce the server to make requests to unintended destinations. Additionally, the exploitation technique involving unescaped remote HTML execution maps directly to CWE-79 Improper Neutralization of Input During Web Page Generation Cross-site Scripting XSS. In terms of adversary behavior, this aligns with MITRE ATT&CK techniques such as T1583 Acquire Infrastructure where attackers may use SSRF to establish footholds or gather intelligence, and T1059 Command and Scripting Interpreter if the injected scripts are used for further exploitation.
Mitigation strategies should prioritize immediate upgrading of the YesWiki installation to version 4.6.7 or later, as this release addresses the input validation flaws in the Bazar valeur action. In environments where patching is not immediately feasible, administrators can implement network-level controls such as web application firewalls that inspect outbound traffic for suspicious patterns indicative of SSRF attempts. Additionally, enforcing strict allowlists for permitted URL schemes and domains within the application configuration can prevent access to internal or loopback addresses. Input validation should also be strengthened on both client and server sides to ensure that any user-supplied URLs are rigorously sanitized before being processed by backend services, thereby neutralizing the vector used for injecting malicious content into rendered pages.