YesWiki EUVD-2026-91481

Exploitation requires an authenticated account with page-editor privileges on the YesWiki instance (CVSS PR:L) and use of the Bazar 'valeur' action's url parameter - the specific feature that fetches the supplied URL server-side. The SSRF half requires the attacker to know or guess internal/loopback targets reachable from the server; the XSS half additionally requires a separate victim to view the page containing the injected unescaped remote HTML for script execution to occur. Limiting factors: no anonymous exploitation is possible (editor-level authentication is mandatory), the XSS branch depends on victim interaction (viewing), and instances must be running a version before 4.6.7.

This is a medium-severity, authenticated dual-flaw (SSRF + stored/reflected XSS, CWE-79) in YesWiki's Bazar 'valeur' action. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 5.3 indicate network-reachable, low-complexity exploitation but requiring low privileges (PR:L) - i.e., an authenticated page editor, not an anonymous attacker. All impact metrics are Low (VC:L/VI:L/VA:L and subsequent-system SC:L/SI:L/SA:L), consistent with information probing rather than full compromise. No EPSS score, SSVC decision, or KEV entry is present in the input, and no public exploit is indicated; there is no public exploit identified at time of analysis. The realistic risk is therefore moderate and gated by the trust model: an organization must already have granted an attacker page-editor rights for exploitation, which contradicts treating this as a mass-exploitable internet threat. The SSRF (fetch arbitrary loopback/internal URLs) is the more serious half, enabling internal service reconnaissance from the server's network position, while the XSS requires a victim to view attacker-injected content. No conflicting signals exist between the CVSS vector and the description - both agree on network vector with required authentication - but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified beyond 'no confirmed active exploitation.'

An attacker holding page-editor credentials on a YesWiki instance (before 4.6.7) submits a Bazar 'valeur' action with a loopback or internal URL (e.g., http://169.254.169.254/ or http://127.0.0.1:port) in the url parameter, causing the server to fetch it and reveal internal service responses. The same action injects unescaped remote HTML, so when another user views the page their browser executes the attacker's script. No public exploit code is identified at time of analysis.