Vulnerability Description
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/ArtalkJS/Artalk
- https://github.com/ArtalkJS/Artalk/blob/v2.10.0/internal/dao/service.go#L96-L103
- https://github.com/ArtalkJS/Artalk/commit/dae6bf49c9efec755a5b3ac3e379b4004c29a0
- https://github.com/ArtalkJS/Artalk/issues/1199
- https://github.com/ArtalkJS/Artalk/releases/tag/v2.10.1
- https://www.vulncheck.com/advisories/artalk-before-2.10.1-unauthenticated-ssrf-v
FAQ
What is CVE-2026-117565?
CVE-2026-117565 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api...
How severe is CVE-2026-117565?
CVE-2026-117565 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-117565?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.