CVE-2026-104442: YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
YesWiki installations running a version before 4.6.7 are affected. Exploitation is network-accessible and does not require authentication or user interaction.
What does an attacker need to do to exploit it?
An attacker can supply a syndication action through the render handler's content parameter. This causes the YesWiki server to fetch an attacker-chosen URL.
What could an attacker access or change through the SSRF?
An attacker can target internal hosts and ports and have fetched feed content rendered back in the page. Feed enclosures may also be downloaded into the files directory.