CVE-2026-104470 describes a server-side request forgery vulnerability in YesWiki before version 4.6.7. The vulnerability exists in the Bazar valeur action, where page editors can supply arbitrary URLs in the url parameter. This allows the server to fetch internal or loopback URLs, potentially exposing internal services. Additionally, the vulnerability enables injection of unescaped remote HTML, which can execute scripts in the browsers of users viewing the pages, leading to cross-site scripting (XSS) impacts. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, requiring privileges of a page editor, no user interaction, scope change, and impacts on confidentiality, integrity, and availability.

An attacker with page editor privileges can exploit this SSRF vulnerability to make the server fetch arbitrary URLs, including internal network resources. This can be used to probe internal services that are otherwise inaccessible externally. Furthermore, the injection of unescaped remote HTML can lead to cross-site scripting attacks affecting users who view the compromised pages, potentially resulting in data theft, session hijacking, or other client-side impacts. The vulnerability affects confidentiality, integrity, and availability of the system.

A fix is available in YesWiki version 4.6.7. Users should upgrade to version 4.6.7 or later to remediate this vulnerability. There is no indication that any temporary or alternative mitigations are provided. Until patched, restricting page editor privileges or limiting access to trusted users may reduce risk.