CVE-2026-117565: Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a pagekey to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Artalk versions before 2.10.1 are affected where remote users can submit anonymous comments to the /api/v2/comments endpoint. The issue does not require authentication or user interaction.
What does an attacker need to do to exploit this?
An attacker submits an anonymous comment with page_key set to a target URL. The server validates only the URL scheme and then fetches the URL to obtain its title.
Can the attacker retrieve data from internal services?
The attacker can cause the Artalk server to request arbitrary URLs, including internal URLs, and can read the fetched page title through the public comment list. The available data indicates title disclosure, not full response-body disclosure.
How can I determine whether exploitation may have occurred?
Review submissions to /api/v2/comments for anonymous comments whose page_key values are unexpected URLs, particularly internal or non-public addresses. Also review publicly visible comment lists for titles associated with such URLs.