Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-62858YOURLS: Unauthenticated File Inclusion

Medium 5.3

In plain English

A medium-severity security flaw in YOURLS from YOURLS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	yourls/yourls	1.10.5	GHSA-f8ff-652m-j5rx

Affected products (as reported)

Vendor	Product	Versions
YOURLS	YOURLS	< 1.10.5

Weakness: CWE-98 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx x_refsource_CONFIRM
https://github.com/YOURLS/YOURLS/pull/4142 x_refsource_MISC
https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb x_refsource_MISC
https://github.com/YOURLS/YOURLS/releases/tag/1.10.5 x_refsource_MISC