YesWiki before version 4.6.7 contains a server‑side request forgery vulnerability in the validateKeyIdUrl() routine that allows unauthenticated attackers to bypass the SSRF guard by using IPv6 transition addresses such as 6to4, NAT64, or IPv4‑compatible addresses. An attacker can send a crafted Signature keyId to the public actor inbox route, causing the server to resolve a URL that points to cloud metadata services, loopback interfaces, or other internal hosts. This enables the attacker to read internal resources, potentially facilitating further compromise or data exfiltration.

The vulnerable product is YesWiki CMS. All releases prior to 4.6.7 are affected. Versions 4.6.7 and newer do not exhibit this flaw.

The CVSS v3.1 score of 8.3 indicates high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication requirements and the use of a public endpoint make exploitation attractive for adversaries seeking privileged internal access. Attackers only need network connectivity to the actor inbox endpoint; no additional privileges are required, making this a compelling target for red or blue teams.