PHP URL Shortener Vulnerability in YOURLS Affects Multiple Versions

CVE-2026-62858

What is CVE-2026-62858?

A vulnerability exists in the YOURLS PHP-based URL shortener that allows unauthenticated remote attackers to exploit the yourls_get_request() function. This function improperly extracts the request path without sanitization, which can lead to directory traversal. Consequently, an attacker can input a malicious keyword that bypasses the sanitization processes and reach file inclusion functions like file_exists() and include(), permitting execution of local files within the YOURLS web process. This vulnerability was addressed in version 1.10.5, urging all users to update immediately to mitigate potential risks.

References