CVE-2026-104470

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-104470
YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44
https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-via-bazar-valeur-action-url-parameter
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44
Configurations

No configuration.

History

04 Oct 2026, 16:16

Type Values Removed Values Added
CWE CWE-79 CWE-918
Summary (en) YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers. (en) YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.
CVSS v2 : unknown
v3 : 7.4 		v2 : unknown
v3 : 5.0
References
  • {'url': 'https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-and-xss-via-bazar-valeur-action', 'source': 'disclosure@vulncheck.com'}
  • () https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23 -
  • () https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-via-bazar-valeur-action-url-parameter -

02 Oct 2026, 16:16

Type Values Removed Values Added
References () https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44 - () https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44 -

02 Oct 2026, 12:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-02 12:17

Updated : 2026-10-04 16:16

NVD link : CVE-2026-104470

Mitre link : CVE-2026-104470

CVE.ORG link : CVE-2026-104470

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)