fkie_cve-2026-63135

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder concatenates labels into inline JavaScript without JavaScript-string escaping, so an unauthenticated attacker can poison the statistics of an existing short URL with a crafted referrer. When an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin and can access admin-visible data, the API signature token, and privileged same-origin actions. This issue is fixed in version 1.10.4.

GHSA-5h77-88j3-r659 — YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Affected: Packagist: yourls/yourls

### Summary

YOURLS stores the HTTP `Referer` header for short URL redirects and later renders aggregated referrer domains in the per-link statistics page. An unauthenticated attacker can send a crafted `Referer` header to any existing short URL. When an authenticated administrator or stats-page viewer opens that short URL's statistics page, the crafted referrer is embedded into Google Charts JavaScript without JavaScript-string escaping, causing stored cross-site scripting.

This is reachable in default private installations when authenticated users view stats, and in documented configurations where `YOURLS_PRIVATE_INFOS` is set to `false` to make statistics pages public.

### Details

The vulnerable source-to-sink path is:

```text HTTP Referer header -> yourls_get_referrer() -> yourls_sanitize_url_safe() -> yourls_log_redirect() -> log table referrer column -> yourls-infos.php referrer aggregation -> yourls_get_domain() -> yourls_stats_pie() -> yourls_google_array_to_data_table() -> inline JavaScript ```

Relevant code:

- `includes/functions.php:240-243`: `yourls_get_referrer()` reads `$_SERVER['HTTP_REFERER']`, calls `yourls_sanitize_url_safe()`, and truncates the result to 200 bytes. - `includes/functions.php:294-307`: `yourls_redirect_shorturl()` calls `yourls_log_redirect()` before redirecting the visitor. - `includes/functions.php:516-545`: `yourls_log_redirect()` stores the sanitized referrer in the log table. - `yourls-infos.php:60-82`: the stati…

Most recent entries from all

fkie_cve-2026-63135

GHSA-5h77-88j3-r659 — YOURLS has stored XSS in referrer statistics chart via crafted Referer header