YesWiki before version 4.6.7 contains an unauthenticated SSRF vulnerability (CWE-918) that enables remote attackers to force the server to send HTTP requests to arbitrary hosts and ports. This is achieved via the url parameter of the {{valeur}} action, which can be submitted through the content parameter in handlers/page/render.php. The vulnerability allows attackers to probe internal HTTP services and retrieve response content formatted as fiche markup. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a network attack vector with low complexity and no privileges or user interaction required, causing limited confidentiality impact.

The vulnerability allows remote attackers to perform SSRF attacks without authentication, potentially enabling them to access internal HTTP services and read sensitive response data. The impact is limited to confidentiality loss; integrity and availability are not affected. There is no indication of active exploitation in the wild.

The vulnerability affects YesWiki versions before 4.6.7. Users should upgrade to version 4.6.7 or later where this issue is fixed. No vendor advisory or patch links were provided in the input, so verify the patch status with the official YesWiki sources before applying updates. Until patched, restrict access to the vulnerable endpoint and monitor for unusual requests targeting the url parameter in the {{valeur}} action.