CVE-2026-62858 YOURLS: Unauthenticated File Inclusion

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourlsgetrequest extracted the request path without sanitization, after which yourlssanitizeurl and yourlsescurl preserved dot and slash traversal sequences before an attacker-controlled keyword reached fileexist...