Vulnerability · Published Oct 2, 2026 · Assigned by VulnCheck

CVE-2026-104440YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter

Medium 5.3

In plain English

A medium-severity server-side request forgery in yeswiki from YesWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints.

Affected products (as reported)

Vendor	Product	Versions
YesWiki	yeswiki	0 – before 4.6.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-gw65-cpc7-hww6) vendor-advisory
VulnCheck Advisory: YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter third-party-advisory