YesWiki versions prior to 4.6.7 contain a server‑side request forgery vulnerability that allows an unauthenticated attacker to supply an arbitrary actor URL to the Bazar abonnements sync action. The application does not validate or sanitize this parameter, so the server performs a GET request to the specified URL and stores the response as a readable Bazar entry. This flaw enables an attacker to read data from internal hosts, cloud metadata services, or other network resources that are normally inaccessible from the web interface, exposing sensitive information and potentially facilitating further attacks.

The vulnerability affects the YesWiki platform, specifically all releases before version 4.6.7. Administrators running these older versions should verify their deployment and determine whether the Bazar abonnements sync feature is enabled.

The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the flaw is readily exploitable via a simple HTTP request and is listed in no current KEV catalog. Attackers can leverage SSRF to target internal resources or cloud metadata points, and the stored responses provide a vector for data exfiltration. The vulnerability does not require authentication, so every visitor to the affected application could potentially exploit it.