https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-03T20:07:51.431645+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-116826 fkie_cve-2026-116826 2026-11-03T20:07:51.459187+00:00

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.

 https://db.gcve.eu/vuln/ghsa-4vj3-p3vv-p25q GHSA-4vj3-p3vv-p25q 2026-11-03T20:07:51.459459+00:00

YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /api/pages/{tag}/duplicate, storing local files, cloud metadata, or database credentials in the publicly accessible files/ directory.