CVE-2026-62858 with a CVSS score of 5.3 is an unauthenticated path traversal and file inclusion vulnerability in YOURLS versions ≤1.10.4, specifically in the way request paths are sanitized before being used to build a local file path. The affected component is the YOURLS URL sanitization logic, which preserves slash and dot characters, allowing traversal sequences to reach file existence and include operations. An attacker can exploit the flaw by sending a crafted request containing traversal characters that causes the application to include a PHP file outside the intended directory, without needing credentials. The attack requires that a PHP file already exists on the server, such as a file uploaded through another weakness or an injected code artifact, and that the attacker can reference its location, even if direct access is blocked. Successful exploitation permits arbitrary PHP code execution, enabling attackers to run malicious commands, access sensitive data, modify system state, or establish persistent access. The business impact includes potential compromise of the web application and underlying server, loss of confidentiality, integrity, and availability, unauthorized administrative control, and downstream risk to users and connected systems.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-62858 with a CVSS score of 5.3 is an unauthenticated path traversal and file inclusion vulnerability in YOURLS versions ≤1.10.4, specifically in the way request paths are sanitized before being used to build a local file path. The affected component is the YOURLS URL sanitization logic, which preserves slash and dot characters, allowing traversal sequences to reach file existence and include operations. An attacker can exploit the flaw by sending a crafted request containing traversal characters that causes the application to include a PHP file outside the intended directory, without needing credentials. The attack requires that a PHP file already exists on the server, such as a file uploaded through another weakness or an injected code artifact, and that the attacker can reference its location, even if direct access is blocked. Successful exploitation permits arbitrary PHP code execution, enabling attackers to run malicious commands, access sensitive data, modify system state, or establish persistent access. The business impact includes potential compromise of the web application and underlying server, loss of confidentiality, integrity, and availability, unauthorized administrative control, and downstream risk to users and connected systems.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]