YesWiki EUVD-2026-91453

Exploitation requires that the YesWiki render handler be network-reachable and that the syndication action is invokable via its content parameter - per the advisory this works against default, unauthenticated configurations of YesWiki before 4.6.7, so no special feature toggle is needed. The practical limiting factor is not authentication (none required) but reachability and impact scope: the attacker must be able to reach the instance over the network, and the payoff depends on what internal hosts/ports and metadata services are reachable from the server and whether the writable files directory is useful to the attacker. There is no user-interaction or privilege requirement to reduce exposure.

This is a moderate-severity, genuinely unauthenticated SSRF (CWE-918) in YesWiki before 4.6.7, scored 6.9 using CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) - remote, network-reachable, low complexity, no privileges and no user interaction, which makes it trivially triggerable against any exposed instance. The impact profile is deliberately bounded: the 4.0 vector reports no direct impact to the vulnerable system's confidentiality (VC:N) but low integrity (VI:L, from forced file downloads into the files directory) and low confidentiality/integrity/availability on subsequent/internal systems (SC:L/SI:L/SA:L), consistent with an SSRF that pivots into the internal network rather than one that directly compromises the host. No EPSS score was provided, so exploitation probability cannot be quantified. This is NOT in CISA KEV and no POC was supplied, so the status is no public exploit identified at time of analysis. The signals are internally consistent - easy to reach, real but limited impact - making this a credible medium-priority patch item especially for internet-exposed wikis, rather than a drop-everything critical. Note that VulnCheck is the reporter and a GHSA advisory exists, so technical validity is well-supported even though no exploitation-in-the-wild evidence is present.

A remote attacker with no credentials sends a request invoking YesWiki's syndication action through the render handler's content parameter, supplying a URL pointing at an internal host or port (e.g. a cloud metadata endpoint or internal admin service). The server fetches that URL and renders the retrieved feed content back into the page, letting the attacker map internal services and exfiltrate reachable content, and can also coerce feed enclosures to be written into the files directory. No public POC was provided, so exploitation would require crafting the request from the advisory details.