Threats tagged 'ghsa-fcvr-25qj-4jg8'

YesWiki versions prior to 4.7.0 have a server-side request forgery (SSRF) vulnerability in the Bazar CSV import function copyUrlToLocalFile(). Authenticated administrators can exploit this by supplying crafted URLs in CSV or image fields, allowing arbitrary outbound requests. The vulnerability enables bypassing extension checks via query-string suffixes or redirects, potentially exposing cloud metadata credentials, internal services, or local files. Responses are stored in a web-accessible directory, increasing exposure risk.