Artalk EUVD-2026-110843

Exploitation requires an Artalk instance before 2.10.1 that performs automatic page-title fetching on comment submission; an unauthenticated attacker sends an anonymous comment to /api/v2/comments with page_key set to an attacker-chosen internal or external URL, which GetTitleByURL fetches after only scheme validation (no host/port/private-IP allowlisting in vulnerable versions). Limiting factors: exfiltration is confined to the fetched resource's HTML title as surfaced in the public comment list (not full response bodies), so SSRF value is reconnaissance and title-level disclosure rather than bulk data theft; the fixed 2.10.1 release disables title auto-fetch by default (page_title_auto_fetch: false) and enforces a trusted_domains/site-URL allowlist across initial requests and redirects, so patched or manually-configured-off instances are not exposed via the comment path.

This is a genuine but moderate-priority issue, best characterized as a medium-severity information-disclosure SSRF rather than a critical remote-code-execution flaw. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the description confirms this: anonymous comments to /api/v2/comments require no account. However, impact is deliberately narrow - only VC:L (limited confidentiality) with VI:N and VA:N - because the attacker recovers only the fetched page's title through the public comment list, not full response bodies, credentials, or write/availability impact. No EPSS score and no KEV status were provided, so there is no evidence of widespread or active exploitation; the vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent SSRF. The signals are internally consistent - network vector, no auth, limited read-only impact - so there is no CVSS-vs-description conflict here. The main uncertainty is EPSS (missing) and real-world exposure of the auto-fetch feature; the vendor patch disables title auto-fetch by default, implying vulnerable (pre-2.10.1) deployments fetched titles automatically on comment submission.

A remote, unauthenticated attacker posts an anonymous comment to /api/v2/comments on an Artalk instance before 2.10.1, setting page_key to an internal URL such as a cloud metadata endpoint or an intranet service. Artalk's GetTitleByURL fetches that URL after validating only the scheme, and the attacker then reads the retrieved page title back through the public comment list, enabling internal network probing and limited data disclosure. No public working exploit is identified in the provided data, though a VulnCheck advisory and the upstream GitHub issue document the flaw.