CVE-2026-63135
CVE-2026-63135 · YOURLS: Stored XSS in referrer statistics chart via crafted Referer header
This page contains facts from public vulnerability sources. Check the original advisory before updating.
YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.
CVSS 8.2 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
yourls
- Versions
- >= 1.5.1, < 1.10.4: Affected
No fix published
yourls/yourls Packagist
- Versions
- 1.10.0
- 1.10.1
- 1.10.2
- 1.10.3
- 1.7.1
- 1.7.2
- 1.7.3
- 1.7.4
- 1.7.5
- 1.7.6
- 1.7.9
- 1.8
- 1.8.1
- 1.8.2
- 1.9
- 1.9.1
- 1.9.2
- Affected ranges
- ECOSYSTEM: ≥ 1.5.1, < 1.10.4
Update to 1.10.4