YouTransfer EUVD-2026-98685

Exploitation targets the Template Rendering component via the /settings/template endpoint and requires that this settings/template-rendering path be network-reachable by the attacker. The input vector claims no privileges are required (PR:N), but because the affected function lives under a /settings administrative/configuration path, authenticated or operator-level access to the settings panel is a plausible and unconfirmed prerequisite - verify whether a default YouTransfer deployment exposes /settings/template without authentication, as this is the primary limiting factor. Affected builds are YouTransfer up to 0.0.7, 1.0.6, and 1.1.0; no vendor patch is confirmed. No user interaction is needed, and a public POC exists, but the limited (Low) impact ratings and the niche deployment footprint constrain real-world blast radius.

Signals are mixed and point to a low-to-moderate, non-urgent priority. The input CVSS 4.0 score is 6.9 (medium) with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/AT:N/PR:N/UI:N) and uniformly Low impacts across confidentiality, integrity and availability. Publicly available exploit code exists (GitHub POC by 0xgh0stri13y), which raises practical likelihood of opportunistic use, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation - this is POC availability, not confirmed exploitation, and the two must not be conflated. A key tension: the vulnerable endpoint is /settings/template (a Template Rendering configuration surface), which in most applications sits behind an administrative/authenticated settings panel, yet the supplied vector asserts PR:N (unauthenticated). This PR:N claim is characteristic of VulDB's optimistic scoring and is not corroborated by a vendor advisory - verify whether the settings endpoint is reachable unauthenticated in a default YouTransfer deployment before treating this as unauthenticated. The reporter is VulDB and the vendor was contacted but did not respond, so there is no authoritative vendor confirmation of impact, affected versions, or a patch. Net: a real but modest issue in a niche self-hosted product; not a drop-everything emergency.

A remote attacker sends a crafted request to the /settings/template endpoint of an exposed YouTransfer instance, supplying a manipulated path parameter containing traversal sequences (e.g. ../../) to escape the intended template directory and reference arbitrary files on the host. Because the manipulation feeds the Template Rendering component, the attacker can read sensitive files outside the web root (and potentially influence rendered output). A public POC exploit script is available on GitHub, lowering the skill barrier to reproduction.