CVE-2026-62858 · GHSA-f8ff-652m-j5rx

YOURLS: Unauthenticated File Inclusion

Risk score: 50/100
CVSS: 5.3 v3.1
Exploit chance (30 days): 0.5%
Published: 14 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and i…
Affected: yourls/yourls (composer) <= 1.10.4
Fix: Upgrade yourls/yourls to 1.10.5 or later.
Exploitation: Public proof of concept

Why it is Yellow

CVSS 5.3 medium
Public exploit or proof of concept referenced
On your watchlist: Composer

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
yourls/yourls	composer	<= 1.10.4	1.10.5

References

Original description

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

Last activity 14 Oct 2026. Patch Forecast updates every hour.