CVE-2026-104459: Yeswiki

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigger HTTPS requests to internal hosts. Attackers can POST a crafted actor_handle with a numeric host and port to the abonnements view to probe internal HTTPS services and ports.

Affected products

• Yeswiki Yeswiki: before 4.6.7 (fixed in 4.6.7)

Published 2026-10-02. Last modified 2026-10-02.