{"id":"CVE-2026-117565","kind":"vulnerability","aliases":["CVE-2026-117565"],"related":[],"title":"Artalk: anonymous comments make the server fetch internal URLs","description":"Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.","summary":"Artalk before 2.10.1 lets anyone post an anonymous comment with a crafted page_key that makes the server request an arbitrary URL, including internal addresses. The attacker can then read the fetched page title back through the public comment list, which exposes internal services to outside callers.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["artalk","go","package","self-hosted"],"not_affected_if":["no-internal-services-reachable","patched-2.10.1-or-later"],"how_to_check":"- Run `artalk version` or check the Artalk release in use; versions below `2.10.1` are affected.\n- Check whether the Artalk server can reach internal-only hosts or metadata addresses from its network.","fix":"- Upgrade Artalk to `2.10.1` or later.\n- Until upgraded, block outbound requests from the Artalk server to internal networks and link-local addresses at the firewall.","status":"open","published_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:33:01+00:00","updated_at":"2026-10-27T14:33:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:33:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Artalk to `2.10.1` or later.\n- Until upgraded, block outbound requests from the Artalk server to internal networks and link-local addresses at the firewall.","reach":"internet","title":"Artalk: anonymous comments make the server fetch internal URLs","impact":"medium","summary":"Artalk before 2.10.1 lets anyone post an anonymous comment with a crafted page_key that makes the server request an arbitrary URL, including internal addresses. The attacker can then read the fetched page title back through the public comment list, which exposes internal services to outside callers.","category":"package","nicknames":[],"who_cares":["artalk","self-hosted","go"],"confidence":0.6,"needs_auth":"no","worst_case":"Server fetches internal URLs and leaks their page titles to outsiders","analyst_note":"","how_to_check":"- Run `artalk version` or check the Artalk release in use; versions below `2.10.1` are affected.\n- Check whether the Artalk server can reach internal-only hosts or metadata addresses from its network.","needs_analyst":false,"not_affected_if":["patched-2.10.1-or-later","no-internal-services-reachable"],"who_is_affected":"Self-hosted Artalk servers below 2.10.1 are exposed, because the comment endpoint accepts anonymous submissions and the server fetches the page_key URL without checking the target address. Servers on networks with internal services reachable from the Artalk host carry the most risk. Instances that are upgraded or sit in a network with no reachable internal hosts can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000622,"input_tokens":3344,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117565':12A,15A '-2026':11A,14A '/api/v2/comments':97C '2.10.1':24B,71C 'address':46B 'allow':82C 'anonym':2A,29B,94C 'anyon':26B 'arbitrari':42B,90C 'artalk':1A,16B,22B,69C 'attack':48B,84C,98C 'back':56B 'caller':68B 'comment':3A,30B,60B,95C,123C 'contain':72C 'craft':33B 'cve':10A,13A 'expos':63B 'fetch':7A,53B,89C,110C 'forgeri':79C 'gettitlebyurl':109C 'go':17B 'host':21B 'includ':44B 'intern':8A,45B,64B,106C 'key':35B,103C 'let':25B 'list':61B,124C 'make':4A,37B,86C 'outsid':67B 'packag':18B 'page':34B,54B,102C,118C 'post':27B 'public':59B,122C 'read':51B,116C 'remot':83C 'request':40B,78C 'scheme':113C 'self':20B 'self-host':19B 'server':6A,39B,76C,88C 'server-sid':75C 'servic':65B 'set':100C 'side':77C 'submit':93C 'titl':55B,119C 'unauthent':74C 'url':9A,43B,91C,107C 'valid':114C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Artalk servers below 2.10.1 are exposed, because the comment endpoint accepts anonymous submissions and the server fetches the page_key URL without checking the target address. Servers on networks with internal services reachable from the Artalk host carry the most risk. Instances that are upgraded or sit in a network with no reachable internal hosts can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117565","severity":null,"published_at":"2026-10-27T14:16:38+00:00","modified_at":"2026-10-27T14:16:38+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}