Artalk vulnerabilities

CVEs whose affected-version data names the Artalk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117565Medium· 5.3

yesterday

Artalk before 2.10.1 Unauthenticated SSRF via Comment Page Title Fetch

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a pag…

▾ SunlitArtalkJS · Artalkvia CVEORG