EUVD-2026-36778
GHSA-68mc-h6h8-79wj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated crafted request to an HTTP service yields arbitrary code execution as the service user, giving full confidentiality, integrity, and availability impact with no user interaction.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.
AnalysisAI
Remote code execution in YouTransfer v1.0.6 allows unauthenticated attackers to run arbitrary code by sending a crafted request to the sendmail transport integration component. The flaw is a CWE-94 code injection issue with a critical CVSS 9.8 score and publicly available exploit code exists via a referenced GitHub gist, though no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
YouTransfer is an open-source self-hosted file transfer web application built on Node.js, designed as a private alternative to services like WeTransfer. The vulnerability resides in its sendmail transport integration, the component responsible for handing off email notifications (such as upload/download links) to the local sendmail binary. CWE-94 (Improper Control of Generation of Code) indicates that user-controlled input is being incorporated into a code or command context without proper neutralization - in this case likely passed to the sendmail invocation, allowing an attacker to inject additional arguments or shell metacharacters that the underlying process interprets as executable code or commands.
RemediationAI
No vendor-released patch identified at time of analysis - the references contain only an NVD entry and a third-party PoC gist, with no upstream commit, release tag, or vendor advisory linked. Administrators running YouTransfer 1.0.6 should monitor the upstream project (github.com/remie/YouTransfer) for a fixed release and, in the interim, switch the email transport configuration away from sendmail to SMTP or another supported backend to remove the vulnerable code path, accepting the trade-off of needing an SMTP relay. Additional compensating controls include placing YouTransfer behind an authenticating reverse proxy or VPN to eliminate unauthenticated network exposure, restricting the OS user account running the Node.js process to a low-privilege sandbox to limit post-exploitation impact, and reviewing sendmail binary permissions and PATH to reduce what an injected command can reach.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today