Unauthenticated Server-Side Request Forgery in Artalk by ArtalkJS
CVE-2026-117565

6.9MEDIUM

Key Information:

Vendor

Artalkjs

Status
Artalk
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117565?

Artalk, prior to version 2.10.1, is susceptible to an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to exploit the server by submitting anonymous comments to the /api/v2/comments endpoint. By setting the page_key to an internal URL, attackers can trigger the GetTitleByURL function, which fetches the internal page title based on scant scheme validation. Subsequently, this compromises the confidentiality of internal resources through the exposure of page titles in the public comment list. Users are advised to upgrade to version 2.10.1 to mitigate this vulnerability.

Affected Version(s)

Artalk 0 < 2.10.1

References

https://github.com/ArtalkJS/Artalk/issues/1199
issue-tracking
https://github.com/ArtalkJS/Artalk
product
https://github.com/ArtalkJS/Artalk/commit/dae6bf49c9efec7...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.