CVE-2026-104470

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description A server-side request forgery (SSRF) issue exists in the Bazar valeur action. Page editors can force the server to fetch arbitrary URLs by manipulating the url parameter. By embedding this action with a champ parameter in wiki markup, attackers can access loopback or internal services, partially read responses rendered on the page, and inject unescaped remote HTML to execute scripts in the browsers of users viewing the page.

Recommendations Update YesWiki to version 4.6.7 or later.