Technical impact
YesWiki before version 4.7.0 contains an unauthenticated SSRF flaw that allows remote attackers to fetch arbitrary URLs by placing [[|URL]] wiki syntax in the content parameter of the page render handler. This results in the server making HTTP requests to arbitrary destinations, potentially exposing internal hosts and services or retrieving sensitive data. The vulnerability is a classic instance of CWE‑918, enabling attackers to read responses from internal networks, facilitating reconnaissance, data exfiltration, or further pivoting.
Affected Systems
The affected product is YesWiki, the open‑source wiki engine. Any installation running a version earlier than 4.7.0 is vulnerable; newer releases have patched the issue.
Risk and Exploitability
The CVSS score of 6.9 indicates medium severity, and the EPSS score is not available, but the flaw can be exploited without authentication by sending a crafted HTTP request to the public render endpoint. Since the vulnerability allows reach to internal hosts, it is particularly dangerous in environments where the web server has network access to sensitive internal resources. The risk is elevated for exposed deployments without network segmentation or firewall rules that restrict outbound traffic from the YesWiki web server to internal IP ranges or critical services. The flaw is not currently listed in the CISA KEV catalog, but its nature warrants prompt remediation.
