CVE-2026-104441
Deferred Deferred - Pending Action

Unauthenticated SSRF in YesWiki via {{valeur}} Action

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104441
EUVD
EUVD-2026-91451

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeswiki yeswiki to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

YesWiki before version 4.6.7 has an unauthenticated server-side request forgery (SSRF) vulnerability. This allows remote attackers to force the server to make HTTP requests to arbitrary hosts and ports using the {{valeur}} action's url parameter. Attackers can exploit this by submitting the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content that matches fiche markup.

Detection Guidance

To detect this vulnerability, monitor for unusual outbound HTTP requests from your YesWiki server, especially those probing internal hosts or ports. Check server logs for {{valeur}} actions with url parameters pointing to unexpected destinations. Use network monitoring tools like tcpdump or Wireshark to capture outbound traffic from the YesWiki server.

Impact Analysis

This vulnerability can allow attackers to access internal services, potentially exposing sensitive data or internal network information. It may also enable probing of internal systems, leading to further attacks or data breaches. The impact includes unauthorized access to internal resources and potential information leakage.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later to patch the vulnerability. If upgrading is not possible, restrict access to the {{valeur}} action by modifying the server configuration to block unauthorized use of the url parameter. Disable outbound HTTP requests from the server if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart