Threats affecting pkg:golang/Artalk

Artalk versions before 2.10.1 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to submit anonymous comments with a crafted page_key parameter pointing to internal URLs. The server fetches these URLs to retrieve page titles without proper validation beyond scheme checking, exposing internal resources via the public comment list.