CVE-2026-63135

HighCVSS 8.2

Published: 21/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

YOURLS, a self-hosted, customizable URL shortener written in PHP, from version 1.5.1 until 1.10.4 stores the HTTP Referer header and aggregates it in statistics, then passes it to the chart builder which concatenates labels into inline JavaScript without proper escaping. This allows an unauthenticated attacker to poison the statistics of an existing short URL with a crafted referrer, leading to execution of malicious JavaScript in the YOURLS origin when an administrator or public stats-page viewer opens the affected page. This issue is fixed in version 1.10.4.

Risk Assessment

An attacker can execute arbitrary JavaScript in the YOURLS context, potentially leading to theft of admin data, API token, and privileged same-origin actions.

Recommendation

It is recommended to immediately upgrade YOURLS to version 1.10.4 or later to prevent exploitation.

Other vulnerabilities in YOURLS

CVE-2020-27388Medium
Multiple stored XSS vulnerabilities exist in the YOURLS Admin Panel, versions 1.5-1.7.10. An authenticated user can inject malicious code by modifying a PHP plugin and uploading it.

Original NVD description (English source)

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.