CVE-2026-62858
MediumCVSS 5.3Summary
YOURLS prior to 1.10.5 does not sanitize the request path in yourls_get_request(), so dot and slash traversal sequences are preserved and reach file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker can traverse outside the pages directory and include a local PHP file already present on the server, causing it to execute in the YOURLS web process. The issue is fixed in version 1.10.5.
Risk Assessment
An attacker can remotely execute an arbitrary local PHP file (e.g. uploaded or injected) in the application context, leading to server compromise or malicious code execution without authentication.
Recommendation
Upgrade YOURLS to version 1.10.5 or later; until then, restrict file upload capabilities and monitor for unusual requests containing ../ sequences in the path.
Other vulnerabilities in YOURLS
See all- CVE-2026-63135High
YOURLS, a self-hosted, customizable URL shortener written in PHP, from version 1.5.1 until 1.10.4 stores the HTTP Referer header and aggregates it in statistics, then passes it to the chart builder which concatenates labels into inline JavaScript without proper escaping. This allows an unauthenticated attacker to poison the statistics of an existing short URL with a crafted referrer, leading to execution of malicious JavaScript in the YOURLS origin when an administrator or public stats-page viewer opens the affected page. This issue is fixed in version 1.10.4.
- CVE-2020-27388Medium
Multiple stored XSS vulnerabilities exist in the YOURLS Admin Panel, versions 1.5-1.7.10. An authenticated user can inject malicious code by modifying a PHP plugin and uploading it.
Original NVD description (English source)
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS