CVE-2026-104442

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.6.7

Description An unauthenticated server-side request forgery (SSRF) allows remote attackers to force the server to fetch arbitrary URLs. This is achieved by providing a syndication action via the content parameter of the render handler. Attackers can target internal hosts and ports, retrieve fetched feed content within the rendered page, and trigger the download of feed enclosures into the files directory.

Recommendations Update YesWiki to version 4.6.7 or later.