---
id: "CVE-2026-117565"
kind: "vulnerability"
aliases: ["CVE-2026-117565"]
title: "Artalk: anonymous comments make the server fetch internal URLs"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["artalk", "go", "package", "self-hosted"]
not_affected_if: ["no-internal-services-reachable", "patched-2.10.1-or-later"]
published_at: "2026-10-27T14:16:38+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:33:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117565", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# Artalk: anonymous comments make the server fetch internal URLs

Artalk before 2.10.1 lets anyone post an anonymous comment with a crafted page_key that makes the server request an arbitrary URL, including internal addresses. The attacker can then read the fetched page title back through the public comment list, which exposes internal services to outside callers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `artalk version` or check the Artalk release in use; versions below `2.10.1` are affected.
- Check whether the Artalk server can reach internal-only hosts or metadata addresses from its network.

## Fix

- Upgrade Artalk to `2.10.1` or later.
- Until upgraded, block outbound requests from the Artalk server to internal networks and link-local addresses at the firewall.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117565

## From the sources

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a page_key to an internal URL, which GetTitleByURL fetches after only scheme validation, then read the page title through the public comment list.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_