Live › vulnerability › CVE-2026-117565
Go to dashboardArtalk before 2.10.1 lets anyone post an anonymous comment with a crafted page_key that makes the server request an arbitrary URL, including internal addresses. The attacker can then read the fetched page title back through the public comment list, which exposes internal services to outside callers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Self-hosted Artalk servers below 2.10.1 are exposed, because the comment endpoint accepts anonymous submissions and the server fetches the page_key URL without checking the target address. Servers on networks with internal services reachable from the Artalk host carry the most risk. Instances that are upgraded or sit in a network with no reachable internal hosts can skip it.
No product ranges from the sources yet.
artalk version or check the Artalk release in use; versions below 2.10.1 are affected.2.10.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.
This page as .md · .json · in your agent: get_signal("CVE-2026-117565")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.