Path Traversal in YouTransfer File Handling

Executive Summary

CVE-2026-109519 is a path traversal vulnerability in YouTransfer versions up to 1.1.0. It allows unauthenticated attackers to write arbitrary files to the server's filesystem via the /settings/template endpoint by manipulating the template parameter with sequences like ../. This enables creating malicious Nunjucks template files in unintended directories such as the application's views folder.

When these templates are rendered via a GET request to the crafted file path, the Nunjucks engine evaluates the injected template code, which can include dangerous JavaScript functions like child_process.execSync(). This grants attackers the ability to execute arbitrary operating system commands with the privileges of the YouTransfer process user.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file writes in the YouTransfer application's views directory, particularly files with unusual names or content. Monitor network traffic for requests to the /settings/template endpoint with suspicious template parameters containing path traversal sequences like ../. Use the provided PoC script to test if the vulnerability is present by attempting to write and render a test file.

Commands to detect: 1) Check logs for access to /settings/template with unusual parameters. 2) Inspect the views directory for recently modified or unknown files. 3) Use curl to send a test request to /settings/template with a path traversal payload and observe if a file is created in the views directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server running YouTransfer. This could lead to complete system compromise, data theft, unauthorized access to sensitive files, or deployment of malware. The attack requires no authentication and can be automated using a proof-of-concept script.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security such as GDPR and HIPAA. It enables unauthorized access to sensitive data, potential data breaches, and lack of proper access controls. Organizations using vulnerable versions may face regulatory penalties, legal consequences, and reputational damage due to insufficient security measures.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /settings/template endpoint by enforcing authentication. Sanitize and validate the template parameter to prevent path traversal attacks. Disable dangerous Nunjucks template constructs that allow command execution. Upgrade YouTransfer to the latest patched version as soon as it is available.

Useful 0 Not Useful 0