Vulnerability Description
YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44
- https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-and-xss-via-bazar
- https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44
FAQ
What is CVE-2026-104470?
CVE-2026-104470 is a vulnerability with a CVSS score of 7.4 (HIGH). YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or ...
How severe is CVE-2026-104470?
CVE-2026-104470 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-104470?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.