GHSA-F8FF-652M-J5RX
Vulnerability from github – Published: 2026-10-15 20:13 – Updated: 2026-10-15 20:13Summary
YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials.
Details
The vulnerability exists because YOURLS uses URL sanitization functions (yourls_sanitize_url(), yourls_esc_url()) to filter request paths, but these functions are designed to clean URLs, not filesystem paths. They preserve / and . characters, allowing ../ sequences to pass through unfiltered.
The unsanitized keyword is then directly concatenated into a filesystem path and passed to file_exists() and later include() operations, enabling path traversal attacks.
Data Flow:
HTTP Request URI (with ../)
↓
yourls_get_request() (no sanitization)
↓
yourls_sanitize_url() (preserves / and .)
↓
yourls_esc_url() (permits / and . via regex)
↓
Keyword extraction (preserves ../)
↓
file_exists(YOURLS_PAGEDIR . "/$keyword.php") ← Sink
↓
include(YOURLS_PAGEDIR . "/$keyword.php") ← Code Execution
Proof of Concept (POC)
In the concept validation, we assume that the attacker has uploaded a test.php file to the web root directory, but it cannot be accessed directly. (Of course, it could also be any path, such as /tmp/test.php)
Setup
Place a test file in web root:
./test.php:
<?php
phpinfo();
?>
Attack Request
GET /../../test HTTP/1.1
Host: target.com
Connection: close
Response (Apache Environment)
Impact
-
Remote execution of uploaded PHP files – An attacker uploads a malicious PHP file to an arbitrary location on the server (e.g., via another vulnerability or file upload feature), obtains its absolute path but cannot access it directly. The attacker then leverages this vulnerability to include and execute the PHP file, gaining code execution privileges.
-
Indirect triggering of PHP code injection – If a PHP code injection point exists on the system (e.g., log injection, session injection) but the injected file cannot be accessed directly due to configuration restrictions, the attacker can use this vulnerability to include and execute the injected code, achieving remote command execution or further compromise.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.10.4"
},
"package": {
"ecosystem": "Packagist",
"name": "yourls/yourls"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-62858"
],
"database_specific": {
"cwe_ids": [
"CWE-98"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-15T20:13:02Z",
"nvd_published_at": "2026-10-14T16:17:47Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nYOURLS versions \u22641.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials.\n\n## Details\n\nThe vulnerability exists because YOURLS uses **URL sanitization functions** (`yourls_sanitize_url()`, `yourls_esc_url()`) to filter request paths, but these functions are designed to clean URLs, not filesystem paths. They preserve `/` and `.` characters, allowing `../` sequences to pass through unfiltered.\n\nThe unsanitized keyword is then directly concatenated into a filesystem path and passed to `file_exists()` and later `include()` operations, enabling path traversal attacks.\n\n**Data Flow:**\n```\nHTTP Request URI (with ../)\n \u2193\nyourls_get_request() (no sanitization)\n \u2193\nyourls_sanitize_url() (preserves / and .)\n \u2193\nyourls_esc_url() (permits / and . via regex)\n \u2193\nKeyword extraction (preserves ../)\n \u2193\nfile_exists(YOURLS_PAGEDIR . \"/$keyword.php\") \u2190 Sink\n \u2193\ninclude(YOURLS_PAGEDIR . \"/$keyword.php\") \u2190 Code Execution\n```\n\n## Proof of Concept (POC)\n\nIn the concept validation, we assume that the attacker has uploaded a `test.php` file to the web root directory, but it cannot be accessed directly. (Of course, it could also be any path, such as `/tmp/test.php`)\n\n### Setup\nPlace a test file in web root:\n\n`./test.php`:\n```php\n\u003c?php\nphpinfo();\n?\u003e\n```\n\u003cimg width=\"502\" height=\"126\" alt=\"image\" src=\"https://github.com/user-attachments/assets/14f33f90-625b-4c65-8abf-244af2385f68\" /\u003e\n\n\n### Attack Request\n```http\nGET /../../test HTTP/1.1\nHost: target.com\nConnection: close\n```\n\n### Response (Apache Environment)\n\n\u003cimg width=\"1704\" height=\"614\" alt=\"image\" src=\"https://github.com/user-attachments/assets/8750a3c0-a96c-4896-a087-d7b5cfeccd30\" /\u003e\n\n\n## Impact\n1. Remote execution of uploaded PHP files \u2013 An attacker uploads a malicious PHP file to an arbitrary location on the server (e.g., via another vulnerability or file upload feature), obtains its absolute path but cannot access it directly. The attacker then leverages this vulnerability to include and execute the PHP file, gaining code execution privileges.\n\n2. Indirect triggering of PHP code injection \u2013 If a PHP code injection point exists on the system (e.g., log injection, session injection) but the injected file cannot be accessed directly due to configuration restrictions, the attacker can use this vulnerability to include and execute the injected code, achieving remote command execution or further compromise.",
"id": "GHSA-f8ff-652m-j5rx",
"modified": "2026-10-15T20:13:03Z",
"published": "2026-10-15T20:13:02Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/YOURLS/YOURLS/security/advisories/GHSA-f8ff-652m-j5rx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62858"
},
{
"type": "WEB",
"url": "https://github.com/YOURLS/YOURLS/pull/4142"
},
{
"type": "WEB",
"url": "https://github.com/YOURLS/YOURLS/commit/4e85972160a96e03a419a442d5bd8f21f2f02ddb"
},
{
"type": "PACKAGE",
"url": "https://github.com/YOURLS/YOURLS"
},
{
"type": "WEB",
"url": "https://github.com/YOURLS/YOURLS/releases/tag/1.10.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "YOURLS: Unauthenticated File Inclusion"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.