CVE-2026-62858
mediumYOURLS is a self-hosted, customizable URL shortener written in PHP.
YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb security-advisories@github.com
- https://github.com/YOURLS/YOURLS/pull/4142 security-advisories@github.com
- https://github.com/YOURLS/YOURLS/releases/tag/1.10.5 security-advisories@github.com
- https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx security-advisories@github.com
- https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx 134c704f-9b21-4f2e-91b3-4a467353bcc0