CVE-2026-52769 Details
Description
YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature() parses the header and immediately makes a server-side HTTP GET to that URL, before any cryptographic verification or URL validation. An unauthenticated remote attacker can therefore make YesWiki issue arbitrary outbound HTTP requests to any host the server can reach - internal services, cloud-metadata endpoints (169.254.169.254), intranet-only admin panels, etc. - and read enough back via timing and error-message oracles to scan ports, enumerate services, and (on a real cloud instance) reach IAM metadata. The only deployment-side precondition is that ActivityPub be enabled on at least one Bazar form. This issue has been patched in version 4.6.6.
A server-side request forgery (SSRF) vulnerability has been identified in YesWiki versions 4.6.2 prior to 4.6.6. The issue arises in the 'POST /api/forms/{formId}/actor/inbox' route, which is publicly accessible. The vulnerability allows an unauthenticated remote attacker to exploit the 'Http Signature' header by providing a 'keyId' parameter that is a URL. The 'HttpSignatureService::verifySignature()' method parses this header and immediately makes an outbound HTTP GET request to the specified URL, without any prior cryptographic verification or URL validation. This flaw enables attackers to make YesWiki issue arbitrary HTTP requests to any reachable host, including internal services, cloud metadata endpoints, and intranet-only admin panels. The response can be manipulated to extract information through timing and error-message oracles, potentially leading to unauthorized access to sensitive data, such as IAM metadata on cloud instances.
Users are advised to upgrade to YesWiki version 4.6.6, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-vw42-752g-5mrp | CISA-ADP | AdvisoryExploitRemedyVendor |
| http://github.com/YesWiki/yeswiki/commit/87e627f33e79879827a3669fee2aa1244612c487 | [email protected] | Source CodeVendor |
| https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 | [email protected] | Release NotesVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-vw42-752g-5mrp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | v4.6.2 (semver) v4.6.3 (semver) v4.6.4 (semver) v4.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |