CVE-2026-62858 YOURLS CVE debrief

Who should care

Defenders responsible for YOURLS deployments should assess exposure and potential impact, focusing on verifying version and ensuring 1.10.5 or later is used. This includes reviewing system logs for suspicious activity, assessing the potential impact of an attack, and implementing compensating controls where necessary. Additionally, security teams should prioritize verifying exposure and assessing potential impact, focusing on YOURLS deployments and

Why it matters

Unauthenticated file inclusion vulnerability in YOURLS allows attackers to execute arbitrary PHP files on the server without credentials.

• Verify YOURLS version and upgrade to 1.10.5 or later
• Assess potential impact and exposure of YOURLS deployments
• Monitor for suspicious activity and implement compensating controls

Technical summary

The vulnerability exists because YOURLS uses URL sanitization functions to filter request paths, but these functions are designed to clean URLs, not filesystem paths. This allows ../ sequences to pass through unfiltered, enabling path traversal attacks that can lead to arbitrary PHP file inclusion and execution. The functions yourls_sanitize_url() and yourls_esc_url() preserve / and . characters, which are critical for path traversal attacks. As a result, attackers can execute malicious PHP files on the server without credentials, posing a significant risk to YOURLS deployments.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on YOURLS deployments and ensuring version 1.10.5 or later is used.

Recommended defensive actions

• Verify YOURLS version and upgrade to 1.10.5 or later if necessary
• Assess potential impact and exposure of YOURLS deployments
• Monitor for suspicious activity and implement compensating controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists due to inadequate URL sanitization, allowing ../ sequences to pass through unfiltered, and enabling path traversal attacks. This issue arises from the misuse of URL sanitization functions (yourls_sanitize_url(), yourls_esc_url()) that preserve / and . characters, which are crucial for path traversal. As a result, attackers can include and execute arbitrary PHP files on the server without credentials, posing a significant risk to YOURLS deployments. Defenders should verify version and ensure 1.10.5 or later is

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.