CVE-2026-62858

Deferred Deferred - Pending Action

Path Traversal in YOURLS URL Shortener

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, after which yourls_sanitize_url() and yourls_esc_url() preserved dot and slash traversal sequences before an attacker-controlled keyword reached file_exists() and include() under YOURLS_PAGEDIR. An unauthenticated remote attacker could traverse outside the intended pages directory and include a local PHP file that was already present on the server, such as an uploaded or injected file, causing the file to execute in the YOURLS web process. This issue is fixed in version 1.10.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62858

EUVD

EUVD-2026-101285

Affected Vendors & Products

Vendor	Product	Version / Range
YOURLS	YOURLS	< 1.10.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-98	The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

Executive Summary

This is a path traversal vulnerability in YOURLS versions 1.10.4 and below. It allows unauthenticated attackers to include and execute arbitrary PHP files on the server by exploiting unsanitized URL paths. The vulnerability occurs because YOURLS uses URL sanitization functions that do not properly handle filesystem paths, allowing '../' sequences to bypass filtering. These paths are then used in file_exists() and include() operations, enabling attackers to traverse directories and execute malicious PHP files uploaded elsewhere on the server.

Detection Guidance

Check YOURLS version with: curl -s https://your-site.com/version.txt | grep -oP '\d+\.\d+\.\d+'. If version is 1.10.4 or below, the system is vulnerable. Test for path traversal by sending requests like: curl -v 'https://your-site.com/yourls-go.php?page=../etc/passwd' to see if files outside the pages directory are accessible.

Inspect server logs for unusual requests containing '../' or '..\' in the page parameter. Use tools like Nikto or Burp Suite to scan for path traversal patterns in URLs targeting YOURLS installations.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary PHP code on your server without authentication. This could lead to full control over your YOURLS instance, data theft, or further compromise of your server. The impact is significant as it allows remote code execution, potentially affecting the confidentiality, integrity, and availability of your system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). A successful exploit may result in unauthorized exposure of sensitive data, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this vulnerability to maintain compliance with these regulations.

Mitigation Strategies

Upgrade YOURLS to version 1.10.5 or later immediately. This version includes fixes for path traversal in the pages feature and other security improvements.

Review and remove any unauthorized or suspicious PHP files on the server, especially in directories accessible via YOURLS. Ensure uploaded files are stored outside the web root or in a restricted directory.

Monitor server logs for signs of exploitation attempts or unauthorized access. Implement network-level protections like WAF rules to block requests containing '../' or '..\' in page parameters.

Hi! I’m here to help you understand CVE-2026-62858. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70