CVE-2026-104441

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary hosts and ports. This is achieved by submitting the url parameter of the {{valeur}} action through the content parameter of the 'handlers/page/render.php' endpoint. This flaw enables the probing of internal HTTP services and the retrieval of response content that matches fiche markup.

Recommendations Update YesWiki to version 4.6.7 or later.