YOURLS: Unauthenticated File Inclusion

Medium · CVSS 5.3

## Summary YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. ## Details The vulnerability exists because YOURLS uses **URL sanitization functions** (`yourls_sanitize_url()`, `yourls_esc_url()`) to filter request paths, but these functions are designed to clean URLs, not filesystem paths. They preserve `/` and `.` characters, allowing `../` sequences to pass through unfiltered.

Remediation

Upgrade yourls/yourls to 1.10.5 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-f8ff-652m-j5rx

← All threats