yeswiki/yeswiki: Unauthenticated Server-Side Request Forgery with response read-back via the [[|URL]] raw-inclusion syntax

Summary

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows any unauthenticated visitor to make the YesWiki server issue HTTP(S) requests to arbitrary hosts and ports — including internal/loopback addresses — and read the response body back in the HTTP reply. This is a new sink of the same unauthenticated-SSRF class already fixed for {{syndication}} (GHSA-jwh5-j4f4-c6xp) and {{valeur}} (GHSA-pghp-rrp4-q666): the shared render gateway is still ungated, and the [[|URL]] raw-inclusion sink was not covered by those fixes. Confirmed live on current HEAD 4ca3fb7 (2026-09-23).

Details

The wakka "raw inclusion from another wiki" syntax [[|URL]] fetches an attacker-controlled URL server-side with no scheme/host/IP validation and echoes the response line by line:

• formatters/wakka.php:310-323 — builds $url from user input, then

return $wiki->Format($wiki->Format($url, 'raw'), 'wakka');

• formatters/raw.php:3 — if ($lines = file($text)) { foreach ($lines as $line) { echo $line; } }

(allow_url_fopen is On by default; file() supports http/https/ftp).

It is reachable unauthenticated through the generic page-render handler, which formats attacker-supplied $_GET['content'] for any visitor with no ACL check — the *same* pre-auth gateway as the two prior SSRF advisories:

• handlers/page/render.php:7-9 —

$this->page['body'] = strip_tags($_GET['content']); $output .= $this->Format($this->page['body']);

• strip_tags() removes HTML but not wiki syntax, so [[|URL]] survives.
• YesWiki::Run() (includes/YesWiki.php:1235-1266) dispatches handlers with no

central read-ACL gate.

The same sink is also reachable stored: a registered editor (POST /api/pages/{tag}, ACL +, includes/controllers/ApiController.php:572) saves a page body containing [[|URL]], which fires when any anonymous visitor views it (handlers/page/show.php:65).

PoC

Default installation, no configuration changes. Stand up any HTTP service on an internal host the client cannot reach directly (models an internal service), then send — with no cookie or authentication:

GET /?wiki=PagePrincipale/render&content=[[|http://INTERNAL_HOST:PORT/x]]

• The YesWiki server issues GET /x/wakka.php?wiki=404/raw to INTERNAL_HOST:PORT

(visible in the target's access log, sourced from the YesWiki container).

• INTERNAL_HOST's response body is reflected back in the HTTP response — full

read-back SSRF. Blind reachability confirmed against arbitrary host:port.

Impact

Unauthenticated attackers can reach internal services and hosts behind the server's network boundary and read their responses.