YesWiki versions prior to 4.6.7 contain a server‑side request forgery flaw in the WebfingerService class. An unauthenticated attacker can send a POST request to the abonnements view with a specially crafted actor_handle that contains a numeric host and port. The vulnerable code then makes an HTTPS request to the supplied address, allowing the attacker to trigger internal HTTPS queries to internal hosts and ports. This flaw is a classic example of CWE‑918, which can potentially lead to information disclosure or further internal enumeration.

The affected product is YesWiki prior to version 4.6.7, distributed by the YesWiki project. No additional sub‑component or distinct version constraints are listed beyond the stated product range.

The CVSS score of 6.9 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires only network connectivity to the YesWiki instance and can craft a POST request without authentication, making exploitation straightforward. The primary risk is the ability to probe internal network services, which may support further attacks or reconnaissance.