Read the docs
TI-2026-74003 Aliases CVE-2026-62858GHSA-f8ff-652m-j5rx

Unauthenticated file inclusion in YOURLS executes local PHP files

Priority MEDIUM 57CWE-98Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-98.

Summary

YOURLS before 1.10.5 does not sanitize the request path before it reaches include() under its pages directory. An unauthenticated remote attacker can traverse out of that directory and include a PHP file already on the server, such as an uploaded file, so it runs in the web process (CWE-98).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed YOURLS (YOURLS): 1.10.5yourls/yourls (Packagist): 1.10.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yourlsYOURLSbefore 1.10.51.10.5Patch availableCNA
—yourls/yourls (Packagist)before 1.10.51.10.5Patch availableGHSA-f8ff-652m-j5rx
  • YOURLS Vendoryourls Affected before 1.10.5 Fixed in 1.10.5 Patch available CNA
  • yourls/yourls (Packagist) Vendor— Affected before 1.10.5 Fixed in 1.10.5 Patch available GHSA-f8ff-652m-j5rx

Remediation

Update YOURLS to version 1.10.5, the fixed version for both the YOURLS product and the yourls/yourls Packagist package.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA YOURLS (YOURLS) Fixed in 1.10.5
  • Fix · GHSA-f8ff-652m-j5rx yourls/yourls (Packagist) Fixed in 1.10.5 Advisory →

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-62858
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-15 Priority changed: LOW → MEDIUM
  4. 2026-10-16 Alias added: GHSA-f8ff-652m-j5rx
  5. 2026-10-16 Fix available: Packagist/yourls/[email protected] · GHSA-f8ff-652m-j5rx
  6. 2026-10-16 CVSS score added · GHSA-f8ff-652m-j5rx
  7. 2026-10-16 Weakness changed · GHSA-f8ff-652m-j5rx
  8. 2026-10-16 6 new references · GHSA-f8ff-652m-j5rx

References

Advisory 1

Other 5

  • TI-2026-45071 YOURLS: Stored XSS in referrer statistics chart via crafted Referer header CVSS 3.1HIGH 8.2
  • TI-2019-10834 YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass. CVSS 3.0CRITICAL 9.8
  • TI-2021-02667 Improper Restriction of Rendered UI Layers or Frames in yourls/yourls CVSS 3.1HIGH 8.8
  • TI-2022-00039 Cross-Site Request Forgery (CSRF) in yourls/yourls CVSS 3.1HIGH 7.4
  • TI-2021-02714 Cross-site Scripting (XSS) - Reflected in yourls/yourls CVSS 3.1MEDIUM 6.1
  • TI-2021-02716 Cross-site Scripting (XSS) - Stored in yourls/yourls CVSS 3.1MEDIUM 5.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences