What is the CVSS score of EUVD-2026-36778?

EUVD-2026-36778 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of YouTransfer are affected by EUVD-2026-36778?

YouTransfer v1.0.6 contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code on affected systems via the sendmail transport integration…

How to fix or mitigate EUVD-2026-36778?

Within 24 hours: Identify all YouTransfer v1.0.6 instances; immediately isolate from internet-facing access and restrict to trusted internal networks only; disable the sendmail transport feature if operationally feasible. Within 7 days: Evaluate upgrade to YouTransfer versions beyond 1.0.6 or transition to an alternative file transfer solution with active vendor support. Within 30 days: Complete decommissioning of YouTransfer v1.0.6 or full transition to a supported replacement system.

YouTransfer EUVD-2026-36778

| CVE-2026-50880 CRITICAL

Code Injection (CWE-94)

2026-06-15 mitre

GHSA-68mc-h6h8-79wj

Code Injection RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated crafted request to an HTTP service yields arbitrary code execution as the service user, giving full confidentiality, integrity, and availability impact with no user interaction.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 13:26 vuln.today

CVSS changed

Jun 16, 2026 - 13:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

AnalysisAI

Remote code execution in YouTransfer v1.0.6 allows unauthenticated attackers to run arbitrary code by sending a crafted request to the sendmail transport integration component. The flaw is a CWE-94 code injection issue with a critical CVSS 9.8 score and publicly available exploit code exists via a referenced GitHub gist, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

YouTransfer is an open-source self-hosted file transfer web application built on Node.js, designed as a private alternative to services like WeTransfer. The vulnerability resides in its sendmail transport integration, the component responsible for handing off email notifications (such as upload/download links) to the local sendmail binary. CWE-94 (Improper Control of Generation of Code) indicates that user-controlled input is being incorporated into a code or command context without proper neutralization - in this case likely passed to the sendmail invocation, allowing an attacker to inject additional arguments or shell metacharacters that the underlying process interprets as executable code or commands.

RemediationAI

No vendor-released patch identified at time of analysis - the references contain only an NVD entry and a third-party PoC gist, with no upstream commit, release tag, or vendor advisory linked. Administrators running YouTransfer 1.0.6 should monitor the upstream project (github.com/remie/YouTransfer) for a fixed release and, in the interim, switch the email transport configuration away from sendmail to SMTP or another supported backend to remove the vulnerable code path, accepting the trade-off of needing an SMTP relay. Additional compensating controls include placing YouTransfer behind an authenticating reverse proxy or VPN to eliminate unauthenticated network exposure, restricting the OS user account running the Node.js process to a low-privilege sandbox to limit post-exploitation impact, and reviewing sendmail binary permissions and PATH to reduce what an injected command can reach.