CVE-2026-117565
Received Received - Intake

Artalk SSRF via Comment Page Key Before 2.10.1

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117565
EUVD
EUVD-2026-110843

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ArtalkJS Artalk 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Artalk before version 2.10.1 has an unauthenticated server-side request forgery (SSRF) vulnerability. Attackers can exploit this by submitting anonymous comments to the /api/v2/comments endpoint. They set a page_key parameter to an internal URL, which the server then fetches after minimal validation. The server reads the page title of the fetched URL and exposes it through the public comment list.

Detection Guidance

Check Artalk logs for unusual requests to /api/v2/comments with page_key set to internal URLs. Monitor network traffic for outbound requests from the Artalk server to unexpected destinations.

Impact Analysis

This vulnerability allows remote attackers to make your server access internal or restricted URLs. This could lead to unauthorized access to sensitive internal services, data exfiltration, or further attacks against internal systems. It may also enable attackers to bypass network restrictions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection principles, and potential legal penalties due to inadequate security measures.

Mitigation Strategies

Upgrade Artalk to version 2.10.1 or later. If immediate upgrade is not possible, restrict access to /api/v2/comments endpoint and validate all page_key values to prevent SSRF attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart