Remote Code Execution in YouTransfer File Transfer

Executive Summary

CVE-2026-50880 is a vulnerability in YouTransfer version 1.0.6 that allows attackers to execute arbitrary code on the server. This happens through the sendmail transport integration component when an attacker with the ability to modify email settings configures the sendmail path to a malicious executable. By crafting a specially formed sender address with a payload, the attacker can trigger command execution with the privileges of the YouTransfer process when a transfer is sent.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on the server running YouTransfer, allowing an attacker to run arbitrary commands with the same privileges as the YouTransfer process. This could result in unauthorized access, data manipulation, or further compromise of the system. However, exploitation requires the attacker to have the ability to modify email settings, so environments where untrusted users cannot change these settings are less at risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the sendmail transport path in YouTransfer version 1.0.6 has been modified to an attacker-controlled executable. Specifically, look for suspicious sendmailPath settings such as "perl" or other unexpected commands.

One way to detect exploitation is to check for the presence of files created by the payload, for example, the file "/tmp/yt_perl_transport_rce" which may be created if the exploit was successful.

Suggested commands to detect potential exploitation or configuration:

• Check the sendmailPath setting in YouTransfer configuration files or database.
• Run: ls -l /tmp/yt_perl_transport_rce # to check if the exploit-created file exists
• Monitor process execution or logs for unexpected commands triggered by sendmail transport.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the ability to modify email settings, especially the sendmail transport path, to trusted administrators only.

Ensure that untrusted users do not have privileges to change the sendmailPath configuration.

Review and reset the sendmail transport path to a safe, expected executable to prevent execution of arbitrary commands.

Monitor the system for any signs of exploitation, such as unexpected files or processes.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0