CVE-2026-104441 Overview
CVE-2026-104441 is an unauthenticated server-side request forgery (SSRF) vulnerability in YesWiki versions before 4.6.7. The flaw resides in the {{valeur}} action, which accepts a user-controlled url parameter without validating the destination host or port. Remote attackers can submit the action through the content parameter of handlers/page/render.php and force the server to issue arbitrary HTTP requests. Response content that matches YesWiki fiche markup is reflected back to the attacker, enabling reconnaissance of internal services and potential exposure of data behind the perimeter. The issue is tracked under [CWE-918] Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can pivot through a YesWiki instance to probe internal HTTP services and exfiltrate response data that conforms to fiche markup.
Affected Products
- YesWiki versions prior to 4.6.7
- Deployments exposing handlers/page/render.php to untrusted networks
- Any YesWiki instance where the {{valeur}} action is enabled
Discovery Timeline
- 2026-10-02 - CVE-2026-104441 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-104441
Vulnerability Analysis
The vulnerability lives in the YesWiki {{valeur}} action handler. That action takes a url parameter and fetches its contents server-side to render dynamic values inside a wiki page. YesWiki does not require authentication to invoke the action, nor does it restrict the destination of the outbound request.
An attacker reaches the action by posting a crafted payload to handlers/page/render.php through the content parameter. The server then performs the HTTP request on behalf of the attacker, from inside the trust boundary of the application host. Any portion of the response matching YesWiki fiche markup is parsed and reflected in the rendered output, giving the attacker a read-back channel for internal content.
Root Cause
The root cause is missing allow-list validation on the url parameter consumed by the {{valeur}} action. YesWiki accepts arbitrary schemes, hosts, and ports, and permits the request to be issued by anonymous users through the public render handler. This matches the classic [CWE-918] pattern where user input directly controls an outbound request target.
Attack Vector
Exploitation is network-based and requires no authentication or user interaction. An attacker submits an HTTP request to handlers/page/render.php containing a content value that invokes {{valeur url="http://target:port/path"}}. The YesWiki server resolves the host, opens a connection, and returns a parsed subset of the response. Attackers can enumerate internal web applications, cloud metadata endpoints reachable over HTTP, and administrative panels bound to localhost.
See the GitHub Security Advisory and the VulnCheck Advisory for YesWiki for additional technical context.
Detection Methods for CVE-2026-104441
Indicators of Compromise
- Unauthenticated POST requests to handlers/page/render.php containing the string {{valeur in the content parameter.
- Outbound HTTP connections from the YesWiki host to internal RFC1918 addresses, loopback, or cloud metadata IPs such as 169.254.169.254.
- Web server access logs showing anonymous sessions submitting repeated valeur actions with varying url targets.
Detection Strategies
- Inspect application and reverse-proxy logs for valeur action invocations originating from untrusted source addresses.
- Correlate web request events with egress firewall logs to flag YesWiki-initiated connections to non-public destinations.
- Alert on anomalous volumes of outbound requests from the web server process that follow receipt of a render.php POST.
Monitoring Recommendations
- Enable verbose HTTP logging on the reverse proxy fronting YesWiki and retain request bodies where policy permits.
- Monitor DNS queries from the YesWiki host for internal hostnames or metadata service domains.
- Track process-level network activity on the web server to establish a baseline of expected outbound destinations.
How to Mitigate CVE-2026-104441
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later on all instances.
- Restrict network egress from the YesWiki host to only the destinations required for operation.
- Place YesWiki behind an authenticating reverse proxy if public exposure is not required.
Patch Information
YesWiki 4.6.7 remediates the SSRF by validating the url parameter supplied to the {{valeur}} action. Administrators should review the maintainers' notes in the GitHub Security Advisory GHSA-pghp-rrp4-q666 and apply the upgrade across all production, staging, and backup instances.
Workarounds
- Block or rewrite POST requests to handlers/page/render.php that contain the {{valeur token at the web application firewall.
- Enforce an egress allow-list on the server so the PHP process cannot reach internal subnets, loopback, or cloud metadata addresses.
- Disable the {{valeur}} action in site configuration if it is not required for the deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
