CVE-2026-104442 Overview
CVE-2026-104442 is an unauthenticated server-side request forgery (SSRF) vulnerability in YesWiki versions before 4.6.7. The flaw resides in the render handler's content parameter, which accepts a syndication action and causes the server to fetch arbitrary URLs. Remote attackers can target internal hosts and ports, read back fetched feed content in the rendered page, and trigger feed enclosures to be downloaded into the YesWiki files directory. The vulnerability is tracked as CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can pivot into internal networks, enumerate internal services, exfiltrate internal HTTP responses through rendered output, and write arbitrary fetched content to the application's files directory.
Affected Products
- YesWiki versions prior to 4.6.7
- YesWiki deployments exposing the render handler to unauthenticated users
- Any YesWiki instance with the syndication action enabled
Discovery Timeline
- 2026-10-02 - CVE-2026-104442 published to the National Vulnerability Database
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-104442
Vulnerability Analysis
YesWiki exposes a render handler that accepts a content parameter describing the action to perform. When attackers supply a syndication action, the handler fetches a remote URL supplied in the request and incorporates the response into the rendered page. The handler does not require authentication and does not restrict the destination of the outbound request. Attackers can therefore coerce the server into issuing HTTP requests to internal hosts, cloud metadata endpoints, loopback services, and arbitrary non-routable address ranges.
The response bypass is amplified by two side effects. First, fetched feed content is rendered back to the attacker, converting the SSRF into an information-disclosure primitive for any internal service that returns parseable feed-like data. Second, feed enclosures referenced in the fetched content are downloaded into the application's files directory, giving attackers a way to persist arbitrary binary content on the server.
Root Cause
The root cause is missing validation of user-supplied URLs passed into the syndication action through the render handler's content parameter [CWE-918]. The code path does not enforce an allowlist of hosts, does not block private and link-local address ranges, and does not require authentication before performing the outbound fetch.
Attack Vector
Exploitation requires only network access to the YesWiki web interface. An unauthenticated attacker issues a request to the render handler with a syndication action and a content parameter pointing at an internal URL. The server performs the fetch using its own network identity, returns the fetched content in the rendered response, and writes any referenced enclosures to the files directory. Full technical detail is published in the GitHub Security Advisory GHSA-jwh5-j4f4-c6xp and the VulnCheck Advisory for YesWiki SSRF.
Detection Methods for CVE-2026-104442
Indicators of Compromise
- Web server access logs containing requests to the YesWiki render handler with a syndication action and a content parameter referencing internal IP ranges, 127.0.0.1, 169.254.169.254, or non-HTTP schemes.
- Unexpected outbound HTTP connections originating from the YesWiki server to internal hosts, cloud metadata endpoints, or attacker-controlled infrastructure.
- New or unexpected files appearing in the YesWiki files directory, particularly binary enclosures fetched from untrusted feeds.
Detection Strategies
- Inspect reverse-proxy and application logs for unauthenticated requests invoking the syndication action with external or RFC1918 URLs in the content parameter.
- Correlate YesWiki process network activity with inbound HTTP requests to identify server-initiated fetches that follow attacker input.
- Monitor the integrity of the files directory and alert on new files whose provenance cannot be mapped to legitimate user uploads.
Monitoring Recommendations
- Forward web, application, and egress firewall logs to a centralized analytics platform and build detections for anomalous outbound requests from the YesWiki host.
- Alert on any outbound traffic from the YesWiki server to internal management interfaces, metadata services, or non-standard ports.
- Baseline normal syndication activity and alert on volume spikes or on requests originating from unauthenticated sessions.
How to Mitigate CVE-2026-104442
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later on all exposed instances.
- Restrict unauthenticated access to the YesWiki render handler at the reverse proxy or web server layer until patching is complete.
- Audit the files directory for unexpected content fetched prior to remediation and remove any attacker-planted artifacts.
Patch Information
The maintainers fixed the issue in YesWiki 4.6.7. Operators should upgrade using the official release channel and verify the installed version after the upgrade. Patch details and backport guidance are documented in the GitHub Security Advisory GHSA-jwh5-j4f4-c6xp.
Workarounds
- Block egress from the YesWiki server to internal network ranges, loopback, and cloud metadata endpoints such as 169.254.169.254.
- Place the YesWiki render handler behind authentication using the reverse proxy where feasible.
- Disable the syndication action if it is not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
