YesWiki EUVD-2026-91450

Exploitation requires that the YesWiki instance (version before 4.6.7) be network-reachable by the attacker and that the /api/entries/bazarlist endpoint be accessible, which it is by default since the flaw is unauthenticated (PR:N/UI:N). The specific trigger is supplying an attacker-controlled URL in the idtypeannonce parameter; no special feature toggle is needed because the isValidURL() function unconditionally returns true, so default configurations are affected. Practical impact is LIMITED by the blind nature (no response content is returned to the attacker) and by what the server can actually reach - real value depends on the presence of exploitable internal services or cloud metadata endpoints routable from the YesWiki host.

This is a medium-severity, unauthenticated blind SSRF (CWE-918) in YesWiki, and the signals are internally consistent rather than conflicting. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated reachability with no user interaction, which raises the practical exposure of any internet-facing instance. However, impact is deliberately scoped low: VC:N reflects the BLIND nature (the attacker does not directly read response bodies), while VI:L/SC:L/SI:L/SA:L capture the ability to pivot requests into internal networks and metadata endpoints. No EPSS score was provided, so widespread-exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' The 6.9 base score is driven by easy unauthenticated access rather than by severe direct impact; the real-world priority is moderate and should be weighted by exposure (internet-facing YesWiki in a cloud environment with reachable metadata/internal services is materially higher risk than an internal-only deployment). The root cause is specific and verifiable: isValidURL() always returns true, so URL validation is effectively absent.

An unauthenticated attacker sends a request to /api/entries/bazarlist with the idtypeannonce parameter set to an internal URL (e.g., a cloud metadata endpoint or an internal service). Because isValidURL() always returns true, loadURLContent() fetches the attacker-supplied URL via curl, letting the attacker map internal networks and reach services not exposed externally. The SSRF is blind (no response body returned), so exploitation relies on timing, error differences, or side effects rather than direct data exfiltration; no public exploit code is referenced.