YOURLS: Unauthenticated File Inclusion

Summary YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. Details The vulnerability exists because YOURLS uses URL sanitization functions yourlssanitizeurl,...

CVE-2026-62858 YOURLS: Unauthenticated File Inclusion

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...