{"id":"CVE-2026-104470","aliases":["EUVD-2026-91481","GHSA-32r4-8mw9-77h4","GHSA-6rvf-7pwm-6j44"],"status":"published","title":"YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00243,"percentile":0.15571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-918"],"published":"2026-10-02T11:38:35Z","modified":"2026-10-28T02:31:01Z","products":[{"vendor":"yeswiki","product":"yeswiki"}],"references":[{"url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23","tags":["patch","fix"]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-via-bazar-valeur-action-url-parameter","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104470","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-ssrf-and-xss-via-bazar-valeur-action"},{"url":"https://github.com/advisories/GHSA-32r4-8mw9-77h4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104470.json","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105224.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105224","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-stored-xss-via-bazar-valeur-action","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104470","title":"YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.","status":"published","published":"2026-10-02T11:38:35.372Z","modified":"2026-10-04T14:59:42.904Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-91481","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.","status":"published","published":"2026-10-02T11:38:35Z","modified":"2026-10-04T14:59:42Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:40.640907Z"}],"ghsa":[{"id":"GHSA-32r4-8mw9-77h4","title":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur...","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability in the Bazar valeur action that allows page editors to make the server fetch arbitrary URLs. Attackers can supply loopback or internal URLs in the url parameter to probe internal services and inject unescaped remote HTML that executes scripts in viewers' browsers.","status":"published","published":"2026-10-02T12:31:17Z","modified":"2026-10-04T18:30:20Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79","CWE-918"],"updated_at":"2026-11-02T15:12:46.728696Z"}],"nvd":[{"id":"CVE-2026-104470","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.","status":"published","published":"2026-10-02T12:17:19.87Z","modified":"2026-10-04T16:16:29.807Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:53.41762Z"}],"osv":[{"id":"CVE-2026-104470","title":"YesWiki before 4.6.7 SSRF via Bazar valeur Action url Parameter","description":"YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs via the url parameter of the Bazar valeur action. Attackers can embed the action with a champ parameter in wiki markup to reach loopback or internal services and partially read responses rendered into the page.","status":"published","published":"2026-10-02T11:38:35.372Z","modified":"2026-11-11T10:47:23.167959108Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-11T03:21:35.242594Z"},{"id":"CVE-2026-105224","title":"YesWiki before 4.6.7 Stored XSS via Bazar valeur Action","description":"YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by rendering unescaped HTML fetched from a remote URL. Attackers can point tools/bazar/actions/valeur.php at a controlled server returning BAZ_fiche_titre markup with an img onerror handler, executing script in every viewer's browser.","status":"published","published":"2026-10-04T15:04:53.749Z","modified":"2026-11-11T10:47:23.169308904Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T03:22:00.901153Z"}]}}