GHSA-qmpm-85pr-3qq8: YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a YesWiki administrator. The vulnerable endpoint is /api/pages/{tag}/duplicate, and exploitation uses the files array supplied to that API.
What data could be exposed?
An administrator can cause the server to retrieve local files or internal resources, including cloud metadata and database credentials. Retrieved content can be stored in the publicly accessible files/ directory.
How can I determine whether my installation is affected?
YesWiki versions before 4.7.0 are affected. Review duplicate-page API activity for requests to /api/pages/{tag}/duplicate containing file:// URLs or URLs pointing to internal services, and inspect the public files/ directory for unexpected downloaded content.