Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
YOURLS versions ≤1.10.4 contain an unauthenticated path traversal vulnerability that allows attackers to include and execute arbitrary PHP files on the server without any credentials. Details The vulnerability exists because YOURLS uses URL sanitization functions (yourlssanitizeurl(), yourlsescurl()) to filter request paths, but these functions are designed to clean URLs, not filesystem paths. They preserve / and . characters, allowing ../ sequences to pass through unfiltered. The unsanitized keyword is then directly concatenated into a filesystem path and passed to fileexists() and later include() operations, enabling path traversal attacks. Data Flow: Proof of Concept (POC) In the concept validation, we assume that the attacker has uploaded a test.php file to the web root directory, but it cannot be accessed directly. (Of course, it could also be any path, such as /tmp/test.php) Setup Place a test file in web root: ./test.php: <img width="502" height="126" alt="image"…
Recommended action: Upgrade to 1.10.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting. This is reachable in default private installations when authenticated users view stats, and in documented configurations where YOURLSPRIVATEINFOS is set to false to make statistics pages public. Details The vulnerable source-to-sink path is: Relevant code: - includes/functions.php:240-243: yourlsgetreferrer() reads $SERVER['HTTPREFERER'], calls yourlssanitizeurlsafe(), and truncates the result to 200 bytes. - includes/functions.php:294-307: yourlsredirectshorturl() calls yourlslogredirect() before redirecting the visitor.…
Recommended action: Upgrade to 1.10.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues.
Recommended action: Upgrade to 1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edit dialog.
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass. Patches https://github.com/YOURLS/YOURLS/releases/tag/1.7.4 https://github.com/YOURLS/YOURLS/pull/2542 References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537 https://github.com/Wocanilo/CVE-2019-14537 For more information If you have any questions or comments about this advisory: Open an issue in YOURLS repository
Recommended action: Upgrade to 1.7.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.