Artalk before 2.10.1 contains an unauthenticated SSRF that allows attackers to send anonymous comments to /api/v2/comments. By setting the page_key to an arbitrary URL, the GetTitleByURL function fetches the target address after only scheme validation. The title of the fetched page is then returned through the public comment list, giving the attacker a view into the content of the external resource. This flaw can be used to probe internal services, exfiltrate data, or mount further attacks that rely on accessing internal network resources via the server.

The vulnerability affects all installations of ArtalkJS:Artalk prior to version 2.10.1. Any deployment using older releases is susceptible when the /api/v2/comments endpoint and GetTitleByURL function are available.

The CVSS score of 6.9 indicates a moderate impact. The flaw is unauthenticated and requires only an HTTP request, so a remote attacker can exploit it from the internet. EPSS is unavailable, but the lack of authentication and the wide availability of the endpoint suggest a non‑negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits are reported at the time of analysis. Attackers could use the ability to fetch arbitrary URLs to probe internal services or to retrieve sensitive data that is only accessible within the network.