CVE-2026-117565 Details
Description
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.
A server-side request forgery (SSRF) vulnerability has been identified in Artalk versions prior to 2.10.1. This vulnerability allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments. The exploitation involves setting a 'page_key' to an internal URL, which is then retrieved by the 'GetTitleByURL' function. The vulnerability arises because the URL fetching only validates the scheme, not the origin, allowing access to internal resources. The fetched page title can be read through the public comment list.
Users are advised to upgrade to Artalk version 2.10.1 or later, where this vulnerability has been fixed. In the updated version, automatic title fetching is disabled by default, and both manual and automatic fetches are restricted to trusted origins.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/artalk-unauthenticated-ssrf-page-key-title-fetch | CISA-ADP | |
| https://github.com/ArtalkJS/Artalk | [email protected] | ProductVendor |
| https://github.com/ArtalkJS/Artalk/blob/v2.10.0/internal/dao/service.go#L96-L103 | [email protected] | Source CodeVendor |
| https://github.com/ArtalkJS/Artalk/commit/dae6bf49c9efec755a5b3ac3e379b4004c29a049 | [email protected] | Source CodeVendor |
| https://github.com/ArtalkJS/Artalk/issues/1199 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ArtalkJS/Artalk/releases/tag/v2.10.1 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/artalk-before-2.10.1-unauthenticated-ssrf-via-comment-page-title-fetch | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Artalk | >= 0, < 2.10.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |