CVE-2026-104441
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 02, 2026
Vendor
unknown
Description
YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary hosts and ports via the { {valeur} } action's url parameter. Attackers can submit the action through the content parameter of handlers/page/render.php to probe internal HTTP services and read back response content matching fiche markup.