MEDIUM 6.9 NVD
CVE-2026-116205
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal hosts and ports and read their responses.
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc
- https://www.vulncheck.com/advisories/yeswiki-before-4.7.0-unauthenticated-ssrf-via-url-raw
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-10-25 via NVD.
vulnfeed aggregates 17091 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.