Is CVE-2026-104470 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104470 being exploited in the wild.

How severe is CVE-2026-104470?

Medium severity, with a CVSS score of 5, published 2 October 2026.

Is there a fix for CVE-2026-104470?

Yes: fixed in 4.6.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104470 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104470?

Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104470: YesWiki Bazar valeur action server-side request forgery

CVE-2026-104470 · Severity: medium · CVSS 5 · Published 2026-10-02

YesWiki is a collaborative wiki platform. The Bazar valeur action allows page editors to embed dynamic content from URLs into wiki pages. A flaw in this action permits editors to make the server fetch arbitrary URLs without restriction, potentially accessing internal services or metadata endpoints, and inject unescaped remote HTML content into pages viewed by other users.

Technologies: YesWiki. Vendors: YesWiki.

Quick answers

Is CVE-2026-104470 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104470 being exploited in the wild.
How severe is CVE-2026-104470?: Medium severity, with a CVSS score of 5, published 2 October 2026.
Which products and versions are affected?: YesWiki 4.6.6 and earlier.
Is there a fix for CVE-2026-104470?: Yes: fixed in 4.6.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104470 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104470?: Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.6.7

Technical details

The tools/bazar/actions/valeur.php action accepts a URL parameter directly from wiki markup, fetches the supplied URL with /html appended, and echoes extracted HTML content without escaping. No URL scheme allowlist, host allowlist, private-network blocking, or output sanitization is implemented. An authenticated page editor can trigger SSRF to reach loopback/internal services and, if responses contain matching Bazar markup, inject raw HTML and JavaScript into rendered pages.

Affected products

YesWiki YesWiki 4.6.6 and earlier

Timeline

2026-09-01: disclosed
2026-07-14: patched: Fix committed before public disclosure
2026-10-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.