PT-2026-2358 · Unknown · Youphptube
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
YouPHPTube versions prior to 7.9
Description
The software contains a local file inclusion issue that allows unauthenticated attackers to access arbitrary files. This is possible by manipulating the
lang parameter in GET requests. The path traversal flaw exists in the locale/function.php file, enabling attackers to include and view PHP files outside the intended directory using directory traversal sequences.Recommendations
Update to version 7.9 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Youphptube