YesWiki EUVD-2026-91469

Requires a YesWiki instance (version < 4.6.7) with the public ActivityPub actor inbox route reachable by the attacker (network-facing federation endpoint). The attacker crafts a Signature keyId containing an IPv6 transition-address representation (6to4, NAT64, or IPv4-compatible IPv6) that defeats validateKeyIdUrl()'s SSRF guard. Realistic impact additionally depends on a valuable internal target being reachable from the server - most notably a cloud metadata endpoint (169.254.169.254), loopback services, or internal hosts; instances with no such reachable internal services yield limited value. Limiting factors beyond CVSS: AC:H/AT:P mean the specific transition-address encoding and network conditions must line up, no authentication is needed (PR:N) but the payload crafting is non-trivial, and no user interaction is required.

This is a credible, above-average-priority SSRF but not an emergency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 8.3 (High): network-reachable and unauthenticated (PR:N), which raises exposure, but AC:H and AT:P signal that successful exploitation is not trivial - the attacker must craft specific IPv6 transition-address payloads (6to4, NAT64, IPv4-compatible IPv6) and the environment must expose a reachable internal target (e.g. a cloud metadata endpoint). Impact is confidentiality-weighted (VC:H, VI:L, VA:N), consistent with reading cloud metadata / internal responses rather than full system compromise. Exploitation status: no public exploit identified at time of analysis (no KEV listing and no POC referenced; the VulnCheck and GHSA entries are advisories, not exploit code). No EPSS score was provided, so statistical exploitation likelihood cannot be compared against the KEV/POC signals - this is a data gap, not evidence of low risk. Net: a patched, real SSRF guard-bypass worth prompt remediation on internet-exposed YesWiki instances, especially those hosted in cloud environments with reachable metadata services, but the AC:H/AT:P friction and absence of confirmed exploitation place it below drop-everything severity.

An attacker sends a crafted HTTP POST to a public YesWiki ActivityPub actor inbox route, placing an IPv6 transition-format address (6to4/NAT64/IPv4-compatible) in the Signature keyId so the server's validateKeyIdUrl() guard fails to recognize it as internal. The server then fetches the attacker-chosen internal URL - for example the cloud metadata service - and the response can expose credentials or internal service data. No authentication and no user interaction are required, though the attacker must know a valid internal target and correctly encode the bypass address (no POC is currently public).