CVE-2026-104441: YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

Q: Which deployments are exposed?

YesWiki deployments running a version before 4.6.7 are affected. The vulnerable request path is handlers/page/render.php, and exploitation uses the {{valeur}} action's url parameter supplied through the content parameter.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability is unauthenticated and can be exploited remotely without user interaction; an attacker can submit a crafted request to make the YesWiki server fetch arbitrary hosts and ports.

Q: What can an attacker obtain through this issue?

An attacker can probe internal HTTP services reachable from the YesWiki server. Response content can be read back when it matches fiche markup.

Published Oct 2, 2026

Updated

YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.

Affected Software

1 affected component

YesWiki YesWiki<4.6.7

Event History

Oct 2, 2026

CVE Published

via MITRE·11:38 AM

Data Sourced

via MITRE·11:38 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

YesWiki deployments running a version before 4.6.7 are affected. The vulnerable request path is handlers/page/render.php, and exploitation uses the {{valeur}} action's url parameter supplied through the content parameter.

Does exploitation require authentication or user interaction?

No. The vulnerability is unauthenticated and can be exploited remotely without user interaction; an attacker can submit a crafted request to make the YesWiki server fetch arbitrary hosts and ports.

What can an attacker obtain through this issue?

An attacker can probe internal HTTP services reachable from the YesWiki server. Response content can be read back when it matches fiche markup.

CVE-2026-104441: YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker obtain through this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker obtain through this issue?