YesWiki CVE-2026-104441

No special conditions beyond a reachable instance - exploitation targets the default {{valeur}} action in YesWiki prior to 4.6.7 by submitting the action through the content parameter of handlers/page/render.php with an attacker-controlled url parameter; the vector (AV:N/PR:N/UI:N/AC:L) confirms no authentication, no user interaction, and no non-default configuration is required. Realistic limits: the attacker must be able to reach the YesWiki HTTP endpoint (internet-facing or network-adjacent), readable content is constrained to responses matching fiche markup, and impact is limited to SSRF-style probing/reading of internal HTTP services rather than direct code execution or data modification on the host.

This is a medium-severity (CVSS 4.0 base 6.9) unauthenticated SSRF (CWE-918) in YesWiki before 4.6.7. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, no-privilege, no-user-interaction exploitation - meaning any remote, unauthenticated attacker can trigger it against a default deployment. Impact metrics are limited: VC:N/VI:L/VA:N with subsequent-system SC:L/SI:L/SA:L, reflecting that the flaw primarily enables probing and limited reading of internal services rather than full compromise. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of trivial exploitability (no auth, low complexity) against a vendor-patched flaw makes this a genuine but moderate priority: easy to abuse for internal reconnaissance and SSRF-based pivoting, but constrained impact and the niche footprint of YesWiki temper the real-world urgency. Patch to 4.6.7 or later; absence of EPSS/KEV signals means exploitation likelihood cannot be quantified from the provided data and should be treated as plausible-but-unconfirmed.

A remote, unauthenticated attacker submits a request to handlers/page/render.php with a content parameter containing the {{valeur}} action and an attacker-chosen url parameter pointing at an internal host and port. The server fetches that URL and returns response content matching fiche markup, letting the attacker map internal HTTP services and exfiltrate reachable response data. No public exploit code is referenced, but the attack requires only a single crafted HTTP request and no authentication.