Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck

CVE-2026-117565Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch

Medium 5.3

In plain English

A medium-severity server-side request forgery in Artalk from ArtalkJS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.

Affected products (as reported)

Vendor	Product	Versions
ArtalkJS	Artalk	0 – before 2.10.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #1199 issue-tracking
https://github.com/ArtalkJS/Artalk product
https://github.com/ArtalkJS/Artalk/commit/dae6bf49c9efec755a5b3ac3e379b4004c29a049 patch
Artalk v2.10.1 Release Notes release-notes
https://github.com/ArtalkJS/Artalk/blob/v2.10.0/internal/dao/service.go#L96-L103 technical-description
VulnCheck Advisory: Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch third-party-advisory
https://hackmd.io/@hieuPenguinnn/artalk-unauthenticated-ssrf-page-key-title-fetch exploit