Vulnerability Description
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action through the render handler's content parameter. Attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and cause feed enclosures to be downloaded into the files directory.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-jwh5-j4f4-c6xp
- https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-unauthenticated-ssrf-v
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-jwh5-j4f4-c6xp
FAQ
What is CVE-2026-104442?
CVE-2026-104442 is a vulnerability with a CVSS score of 5.8 (MEDIUM). YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by supplying a syndication action throug...
How severe is CVE-2026-104442?
CVE-2026-104442 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-104442?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.