YOURLS: Unauthenticated File Inclusion (CVE-2026-62858)

YOURLS versions <=1.10.4 have a path traversal vulnerability due to improper sanitization of request paths. The functions yourls_sanitize_url() and yourls_esc_url() are designed for URL cleaning but preserve '/' and '.' characters, allowing '../' sequences to pass. These unsanitized keywords are concatenated into filesystem paths and used in file_exists() and include() calls, enabling attackers to include arbitrary PHP files and execute code remotely without authentication. The vulnerability can be exploited by sending HTTP requests with '../' sequences in the URI to include PHP files located outside the intended directory.

An attacker can achieve remote code execution by including and running arbitrary PHP files on the server without authentication. This can be leveraged if the attacker has previously uploaded a malicious PHP file or if PHP code injection exists elsewhere but cannot be accessed directly. The vulnerability allows bypassing access restrictions and executing injected or uploaded code, potentially leading to full system compromise.

A patch is available for this vulnerability. Users should upgrade YOURLS to version 1.10.5 or later where this issue is fixed. Until patched, avoid exposing YOURLS instances to untrusted users or networks. No vendor advisory content contradicts this; therefore, applying the official fix is the recommended mitigation.