YOURLS CVE-2026-62858

Exploitation requires an attacker-controlled PHP file to ALREADY exist on the server (the description names 'an uploaded or injected file') that is reachable by traversing outside YOURLS_PAGEDIR; the bug only provides the inclusion primitive, not the file itself, so a separate upload/write vector is a hard prerequisite. The affected code path is yourls_get_request() feeding an unsanitized keyword through yourls_sanitize_url()/yourls_esc_url() into file_exists()/include(). Affected: all YOURLS versions prior to 1.10.5. Limiting factors: the precondition of a pre-existing executable PHP file substantially constrains real-world exploitation, and there is an unresolved conflict over whether authentication is required - the description says unauthenticated while the provided CVSS vector encodes PR:L (authenticated) and AV:L (local), so authentication requirements are not confirmed from available data.

This is a medium-severity (CVSS 5.3) PHP local file inclusion via path traversal in YOURLS, and the signals point to a conditional, chaining gadget rather than a top-tier emergency. A key data conflict must be stated explicitly: the input CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N (local attack vector, low-privilege/authenticated), but the description explicitly says an 'unauthenticated remote attacker' can exploit it - these contradict each other and should be verified against the vendor advisory (GHSA-f8ff-652m-j5rx). No EPSS probability was provided, the CVE is not listed in CISA KEV, and no public exploit code was identified at time of analysis, so there is no evidence of active or widespread exploitation. The most important risk-limiting factor is intrinsic to the bug: exploitation only yields code execution if an attacker-controlled PHP file is ALREADY present on the server (uploaded or injected via a separate weakness). That makes this a second-stage LFI-to-RCE primitive that amplifies an existing foothold, not a standalone unauthenticated RCE - it becomes a real priority primarily where a file-upload or file-write vector coexists. Conclusion: patch promptly to 1.10.5, but absent KEV/EPSS/POC signals this is a moderate, defense-in-depth priority rather than a critical drop-everything issue.

An attacker who has already managed to place a PHP file on the server (for example an uploaded avatar/plugin file or a file injected through a separate flaw) sends a request to the YOURLS front controller using a short-URL keyword containing ../ traversal sequences. Because yourls_get_request() extracts the path without sanitization and yourls_sanitize_url()/yourls_esc_url() preserve the dot-slash sequences, the crafted keyword reaches file_exists() and include() under YOURLS_PAGEDIR, causing the planted PHP file to execute in the YOURLS web process. No public exploit code is identified at time of analysis, and the attack is gated on that pre-existing file.