CVE-2026-104464: YesWiki SSRF Vulnerability

CVE-2026-104464 Overview

CVE-2026-104464 is a server-side request forgery (SSRF) vulnerability in YesWiki versions prior to 4.6.7. The flaw resides in the Bazar abonnements sync action, which accepts an unvalidated actor URL parameter. Unauthenticated attackers can coerce the YesWiki server into issuing GET requests to arbitrary destinations, including internal services and cloud metadata endpoints. Fetched responses are stored as readable Bazar entries, giving the attacker a reliable channel to retrieve the responses. Attackers can also chain attacker-controlled outbox first and next links to pivot across multiple internal URLs through a single request.

Critical Impact
Unauthenticated attackers can reach internal network services and cloud instance metadata endpoints, then exfiltrate the fetched contents through readable Bazar entries.

Affected Products

YesWiki versions prior to 4.6.7
YesWiki Bazar abonnements sync functionality
Self-hosted YesWiki deployments exposing the Bazar sync action

Discovery Timeline

2026-10-02 - CVE-2026-104464 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104464

Vulnerability Analysis

The vulnerability is classified as a server-side request forgery issue [CWE-918]. YesWiki's Bazar abonnements sync action accepts an actor parameter that is treated as a URL and fetched server-side without destination validation. Because the action is reachable without authentication, any remote attacker can direct the server to perform outbound GET requests on their behalf.

The fetched content is not discarded. YesWiki persists the response payload as a Bazar entry that the attacker can subsequently read. This converts the SSRF into a full read primitive against any HTTP-reachable resource the YesWiki host can see.

Attackers can further chain the behavior by pointing the actor to an outbox under their control. The outbox then returns first and next links referencing internal URLs, driving YesWiki through a sequence of attacker-chosen fetches during a single sync operation.

Root Cause

The root cause is missing validation and allowlisting of the actor URL supplied to the Bazar abonnements sync endpoint. The implementation does not restrict the scheme, host, or address range of the fetch target, and it does not filter responses before storing them as Bazar entries. ActivityPub-style outbox pagination is followed without sanitizing the subsequent URLs.

Attack Vector

Exploitation requires only network access to the YesWiki instance. An unauthenticated attacker submits a crafted request to the Bazar abonnements sync action with an actor URL pointing at an internal service (for example, http://127.0.0.1, internal RFC1918 ranges, or the cloud metadata endpoint at 169.254.169.254). YesWiki issues the request from its own network position, stores the response as a Bazar entry, and the attacker retrieves the entry through the normal Bazar read interface. See the GitHub Security Advisory and the VulnCheck SSRF Advisory for technical details.

// No verified proof-of-concept code is publicly available.
// Refer to the GitHub Security Advisory GHSA-wcjp-v62j-p5xm for technical details.

Detection Methods for CVE-2026-104464

Indicators of Compromise

Bazar entries whose stored content matches internal HTTP responses, cloud metadata JSON, or configuration data not sourced from a legitimate federated peer.
Outbound HTTP requests from the YesWiki host to loopback addresses, RFC1918 ranges, or 169.254.169.254 originating from the PHP runtime.
Unauthenticated requests to the Bazar abonnements sync action carrying an actor parameter pointing at non-federated hosts.

Detection Strategies

Review web server access logs for requests to the Bazar abonnements sync endpoint with actor values that resolve to private, loopback, link-local, or metadata address space.
Correlate incoming sync requests with outbound connections from the YesWiki process to detect SSRF pivoting across chained first and next links.
Inspect newly created Bazar entries for payloads that resemble internal service responses rather than ActivityPub actor documents.

Monitoring Recommendations

Alert on any egress from application servers to 169.254.169.254 or other cloud metadata endpoints.
Monitor the creation rate of Bazar entries and flag spikes aligned with unauthenticated sync requests.
Enable PHP outbound HTTP logging where available to attribute SSRF traffic to specific request contexts.

How to Mitigate CVE-2026-104464

Immediate Actions Required

Upgrade YesWiki to version 4.6.7 or later on all exposed instances.
Audit existing Bazar entries for content retrieved from internal addresses and remove suspicious records.
Rotate any credentials, tokens, or cloud instance metadata secrets that may have been exposed through SSRF retrieval.

Patch Information

The maintainers fixed the issue in YesWiki 4.6.7. Review the GitHub Security Advisory GHSA-wcjp-v62j-p5xm for upgrade guidance and the full list of changes.

Workarounds

Block unauthenticated access to the Bazar abonnements sync action at the reverse proxy or web application firewall until the upgrade is applied.
Restrict outbound HTTP egress from the YesWiki host to a known allowlist of federated peers, and deny traffic to loopback, RFC1918, and link-local ranges.
On cloud providers that support it, enforce Instance Metadata Service v2 (IMDSv2) and set the metadata hop limit to 1 to blunt SSRF against the metadata endpoint.

bash

# Example nginx snippet to block the vulnerable action pending patching
location ~* /\?.*action=bazar_abonnements_sync {
    return 403;
}