CVE-2026-52769
Received Received - Intake

Server-Side Request Forgery in YesWiki

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: GitHub, Inc.

Description
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL validation. An unauthenticated remote attacker can therefore make YesWiki issue arbitrary outbound HTTP requests to any host the server can reach - internal services, cloud-metadata endpoints (169.254.169.254), intranet-only admin panels, etc. - and read enough back via timing and error-message oracles to scan ports, enumerate services, and (on a real cloud instance) reach IAM metadata. The only deployment-side precondition is that ActivityPub be enabled on at least one Bazar form. This issue has been patched in version 4.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-52769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects YesWiki versions 4.6.2 to 4.6.5. It involves a publicly exposed API route that accepts an HTTP Signature header with a keyId parameter as a URL. The server immediately makes an outbound HTTP GET request to that URL without validating or verifying the signature first. This allows unauthenticated attackers to force the server to make arbitrary requests to any reachable host, enabling port scanning, service enumeration, and potential access to sensitive endpoints.

Detection Guidance

Check YesWiki logs for unusual outbound HTTP requests from the server, especially to internal or cloud-metadata endpoints. Monitor network traffic for unexpected connections initiated by the YesWiki process.

Impact Analysis

If you run a vulnerable YesWiki instance with ActivityPub enabled on a Bazar form, attackers can exploit this to scan your internal network, access cloud metadata endpoints, or interact with intranet services. This could lead to data leaks, unauthorized access, or service disruption. The impact depends on your server's network access and configuration.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data or allowing unauthorized access to systems. GDPR may require breach notification if personal data is exposed. HIPAA could be violated if protected health information is accessible. The risk depends on the data processed by the YesWiki instance and the attacker's ability to exfiltrate or manipulate it.

Mitigation Strategies

Upgrade YesWiki to version 4.6.6 or later immediately. If upgrading is not possible, disable the ActivityPub feature on Bazar forms or restrict access to the vulnerable API endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart