{"id":"CVE-2026-104440","published":"2026-10-02T12:17:14.837","lastModified":"2026-10-02T15:17:06.893","description":"YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.","cvssScore":5.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gw65-cpc7-hww6","tags":[]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-blind-ssrf-via-bazarlist-api-idtypeannonce-parameter","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gw65-cpc7-hww6","tags":[]}],"exploitRefs":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gw65-cpc7-hww6","tags":[]},{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-gw65-cpc7-hww6","tags":[]}],"hasPoc":true,"ai":null}