# CVE-2026-104470: YesWiki Bazar valeur action server-side request forgery

Source: https://junglewise.ai/threats/cve-2026-104470-yeswiki-before-4-6-7-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104470 · Severity: medium · CVSS 5 · Published 2026-10-02

YesWiki is a collaborative wiki platform. The Bazar valeur action allows page editors to embed dynamic content from URLs into wiki pages. A flaw in this action permits editors to make the server fetch arbitrary URLs without restriction, potentially accessing internal services or metadata endpoints, and inject unescaped remote HTML content into pages viewed by other users.

Technologies: [YesWiki](https://junglewise.ai/threats/technologies/yeswiki). Vendors: [YesWiki](https://junglewise.ai/threats/vendors/yeswiki).

## Quick answers

**Is CVE-2026-104470 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104470 being exploited in the wild.

**How severe is CVE-2026-104470?** Medium severity, with a CVSS score of 5, published 2 October 2026.

**Which products and versions are affected?** YesWiki 4.6.6 and earlier.

**Is there a fix for CVE-2026-104470?** Yes: fixed in 4.6.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104470 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-104470?** Check whether you run YesWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.6.7

## Technical details

The tools/bazar/actions/valeur.php action accepts a URL parameter directly from wiki markup, fetches the supplied URL with /html appended, and echoes extracted HTML content without escaping. No URL scheme allowlist, host allowlist, private-network blocking, or output sanitization is implemented. An authenticated page editor can trigger SSRF to reach loopback/internal services and, if responses contain matching Bazar markup, inject raw HTML and JavaScript into rendered pages.

## Affected products

- YesWiki YesWiki 4.6.6 and earlier

## Timeline

- 2026-09-01: disclosed
- 2026-07-14: patched: Fix committed before public disclosure
- 2026-10-02: advisory

## References

- [https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23](https://github.com/YesWiki/yeswiki/commit/22a5260b0381824e01d340ce9457c4adb9e18b23)
- [https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44](https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6rvf-7pwm-6j44)

## Related threats

- [YesWiki SQL injection in despam.php INTERVAL operand](https://junglewise.ai/threats/cve-2026-116828-yeswiki-before-4-7-0-contains-a-sql-injection-vulnerability-in)
- [YesWiki server-side request forgery in Bazar CSV import](https://junglewise.ai/threats/cve-2026-116827-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki server-side request forgery in DuplicationManager](https://junglewise.ai/threats/cve-2026-116826-yeswiki-before-4-7-0-contains-a-server-side-request-forgery)
- [YesWiki HTTP Signature replay protection missing in ActivityPub inbox](https://junglewise.ai/threats/cve-2026-116825-yeswiki-from-4-6-2-before-4-7-0-lacks-replay-protection-in)
- [YesWiki stored cross-site scripting in referrers_sites handler](https://junglewise.ai/threats/cve-2026-116824-yeswiki-before-4-7-0-contains-a-stored-cross-site-scripting)