Youtransfer
Monthly
Path traversal in YouTransfer (versions up to 0.0.7, 1.0.6, and 1.1.0) lets an attacker manipulate the /settings/template endpoint of the Template Rendering component to reach files outside the intended directory, yielding limited confidentiality, integrity, and availability impact (CWE-22). Publicly available exploit code exists, including a GitHub proof-of-concept; no public exploit activity has been confirmed beyond the POC, and the CVE is not reported as actively exploited. The vendor was contacted about the disclosure but did not respond, and no vendor patch is confirmed, so exposure is governed mainly by whether the /settings/template path is reachable and whether that administrative settings surface is protected by authentication in a given deployment.
Path traversal in YouTransfer (versions up to 0.0.7, 1.0.6, and 1.1.0) lets an attacker manipulate the /settings/template endpoint of the Template Rendering component to reach files outside the intended directory, yielding limited confidentiality, integrity, and availability impact (CWE-22). Publicly available exploit code exists, including a GitHub proof-of-concept; no public exploit activity has been confirmed beyond the POC, and the CVE is not reported as actively exploited. The vendor was contacted about the disclosure but did not respond, and no vendor patch is confirmed, so exposure is governed mainly by whether the /settings/template path is reachable and whether that administrative settings surface is protected by authentication in a given deployment.