CVE-2026-104470: YesWiki SSRF Vulnerability

CVE-2026-104470 Overview

CVE-2026-104470 is a Server-Side Request Forgery (SSRF) vulnerability in YesWiki versions before 4.6.7. The flaw resides in the Bazar valeur action, which accepts a user-controlled url parameter without validation. Any user with page-editing permissions can embed the action in wiki markup with a champ parameter to force the server to fetch arbitrary URLs. The response is partially rendered back into the rendered wiki page, exposing content from loopback interfaces and internal network services. The vulnerability is tracked as [CWE-918].

Critical Impact
Authenticated page editors can pivot through the YesWiki server to reach internal services, cloud metadata endpoints, and loopback-bound applications, with portions of the response exposed in rendered pages.

Affected Products

YesWiki versions prior to 4.6.7
Deployments exposing the Bazar extension with page-edit permissions
Self-hosted YesWiki instances reachable from internal networks

Discovery Timeline

2026-10-02 - CVE-2026-104470 published to NVD
2026-10-04 - Last updated in NVD database

Technical Details for CVE-2026-104470

Vulnerability Analysis

The Bazar extension in YesWiki provides a valeur action that extracts a specific field (champ) from an external Bazar entry referenced by a URL. The implementation in tools/bazar/actions/valeur.php reads the url parameter directly from the action invocation and passes it to file_get_contents() without validating the scheme, host, or destination. Because wiki syntax embeds this action inline, any editor can author a page that triggers an outbound HTTP request from the server. The fetched content is then partially rendered into the page response, enabling the editor to exfiltrate portions of internal responses.

Root Cause

The root cause is missing validation of the url parameter in the valeur action handler. The legacy code concatenated /html to attacker-controlled input and invoked @file_get_contents($url . '/html'), treating any supplied URL as trusted. No allowlist of hosts, no scheme restriction, and no network boundary check was applied before the outbound request.

Attack Vector

An attacker with page-edit privileges inserts the Bazar valeur action in wiki markup, supplying a url parameter pointing to an internal resource and a champ parameter to trigger the fetch path. When the page renders, the YesWiki server issues the HTTP request from its own network position. Targets include http://127.0.0.1, internal RFC1918 services, and cloud instance metadata services. The fetched payload is parsed and partial field content is reflected into the rendered page.

php

// Vulnerable logic from tools/bazar/actions/valeur.php (pre-patch)
$url = $this->GetParameter('url');
if (empty($url) && isset($this->config['source_url']) && !empty($this->config['source_url'])) {
    $url = $this->config['source_url'];
}
if (!empty($url)) {
    $champ = $this->GetParameter('champ');
    // ...
    if (!empty($champ)) {
        if (!isset($GLOBALS['externalpage'][$url])) {
            // Unvalidated outbound fetch — SSRF sink
            $GLOBALS['externalpage'][$url] = @file_get_contents($url . '/html');
        }
        // Response fields are rendered back into the wiki page
    }
}

Source: YesWiki patch commit 22a5260

Detection Methods for CVE-2026-104470

Indicators of Compromise

Wiki page revisions containing the {{valeur ...}} action with url parameters pointing to 127.0.0.1, localhost, RFC1918 ranges, or 169.254.169.254.
Web server access logs showing outbound HTTP requests to internal hosts originating from the PHP process.
Unusual file_get_contents network calls traced to tools/bazar/actions/valeur.php.

Detection Strategies

Audit the YesWiki page history and database for Bazar action invocations referencing non-public URLs.
Monitor egress traffic from the YesWiki host for connections to loopback, link-local, or internal management interfaces.
Review editor accounts that created or modified pages invoking the valeur action after installation.

Monitoring Recommendations

Enable PHP network logging or wrap file_get_contents via a stream wrapper to log outbound destinations.
Alert on HTTP requests from the web application to cloud metadata endpoints such as 169.254.169.254.
Correlate wiki edit events with server-initiated outbound HTTP activity to identify abuse patterns.

How to Mitigate CVE-2026-104470

Immediate Actions Required

Upgrade YesWiki to version 4.6.7 or later, which refactors the valeur action and applies URL validation.
Restrict page-edit permissions to trusted users until the upgrade is deployed.
Review all existing wiki content for pages containing the valeur action with suspicious url values.

Patch Information

The fix is delivered in YesWiki commit 22a5260 and documented in GitHub Security Advisory GHSA-6rvf-7pwm-6j44. The patch refactors tools/bazar/actions/valeur.php to validate URLs before fetching. Additional context is available in the VulnCheck advisory.

Workarounds

Block outbound HTTP traffic from the YesWiki host to internal networks, loopback, and cloud metadata endpoints at the firewall or egress proxy.
Run the YesWiki PHP process in a network namespace that cannot reach sensitive internal services.
Temporarily disable the Bazar extension if upgrading is not immediately feasible.

bash

# Example iptables egress restriction for the YesWiki host
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT