CVE-2026-104440

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An unauthenticated attacker can perform a blind server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This is possible via the '/api/entries/bazarlist' endpoint using the idtypeannonce parameter. The issue exists because the isValidURL() function always returns true, allowing the loadURLContent() function to use curl to fetch internal URLs. This can be used to probe internal networks and access internal services or metadata endpoints.

Recommendations Update YesWiki to version 4.6.7 or later. As a temporary workaround, restrict access to the '/api/entries/bazarlist' endpoint.