CVE-2026-104458: YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
YesWiki versions before 4.6.7 are affected if the public actor inbox route is reachable by an attacker. Exploitation does not require authentication.
What does an attacker need to exploit the vulnerability?
An attacker needs to send a crafted Signature keyId to the public actor inbox route. The keyId can use 6to4, NAT64, or IPv4-compatible IPv6 address forms to bypass the SSRF guard in validateKeyIdUrl().
What systems could be reached if exploitation succeeds?
The vulnerable server may be induced to make requests to cloud metadata endpoints, loopback services, or internal hosts. This can expose sensitive data and may allow limited integrity impact depending on the services reachable from the YesWiki server.