DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63135: CVE-2026-63135: Stored Cross-Site Scripting (XSS) via Referer Header in YOURLS

#security #cve #cybersecurity

CVE-2026-63135: Stored Cross-Site Scripting (XSS) via Referer Header in YOURLS

Vulnerability ID: CVE-2026-63135
CVSS Score: 8.2
Published: 2026-08-21

CVE-2026-63135 is a critical stored Cross-Site Scripting (XSS) vulnerability affecting YOURLS (Your Own URL Shortener) versions 1.5.1 up to (but not including) 1.10.4. Unauthenticated remote attackers can inject malicious JavaScript arrays by crafting an HTTP Referer header sent to a short URL redirect. This value is saved in the database logs and executed without context-aware escaping when an administrative user views the corresponding statistics visualization page.

TL;DR

Unauthenticated stored XSS in YOURLS via crafted Referer headers allows hijacking administrative browser sessions when administrators view short URL statistics.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79 (Improper Neutralization of Input During Web Page Generation)
  • Attack Vector: Network (Unauthenticated HTTP Request)
  • CVSS v3.1 Score: 8.2 (High)
  • Exploit Status: Proof of Concept (PoC) available and verified
  • CISA KEV Status: No
  • Scope Impact: Changed (Client-side execution on admin origin)

Affected Systems

  • YOURLS (Your Own URL Shortener)
  • YOURLS: >= 1.5.1, < 1.10.4 (Fixed in: 1.10.4)

Code Analysis

Commit: e1e9347

Fix XSS in referrers statistics

Exploit Details

  • GitHub Security Advisory: Verification harness code targeting YOURLS domain extraction, string sanitization, and inline script generation engines.

Mitigation Strategies

  • Upgrade YOURLS instances to version 1.10.4 or higher.
  • Enforce private administrative statistics dashboards by configuring YOURLS_PRIVATE_INFOS to true in user/config.php.
  • Configure Web Application Firewall (WAF) filter rules to intercept and block HTTP requests with single quotes or brackets inside the Referer header.

Remediation Steps:

  1. 1. Secure a full backup of the YOURLS database and instance configuration files.
  2. 2. Deploy the YOURLS 1.10.4 application update.
  3. 3. Inspect the active database log table (specifically the redirect logging schema) for existing referrers containing suspicious punctuation patterns.
  4. 4. Purge any detected malicious entries from the log history to clean existing databases.

References

Read the full report for CVE-2026-63135 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)