PT-2026-123046

CVE-2026-116205

Published

2026-10-25

Updated

2026-10-25

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions YesWiki versions prior to 4.7.0

Description An unauthenticated server-side request forgery (SSRF) allows remote attackers to fetch arbitrary URLs. This occurs when the render handler processes [[|URL]] wiki syntax. Attackers can use the content parameter of the page render handler to access internal hosts and ports and read the resulting responses.

Recommendations Update to version 4.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers

CVE-2026-116205