CVE-2026-62858

MEDIUM 5.3

YOURLS: Unauthenticated File Inclusion

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

CWE	CWE-98
Vendor	yourls
Product	yourls
Published	Oct 14, 2026
Last Updated	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for yourls yourls

Be the first to know when new medium vulnerabilities affecting yourls yourls are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

YOURLS / YOURLS

< 1.10.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx github.com: https://github.com/YOURLS/YOURLS/pull/4142 github.com: https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb github.com: https://github.com/YOURLS/YOURLS/releases/tag/1.10.5