CVE-2026-109519 Details
Description
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A path traversal vulnerability allowing for remote code execution has been identified in YouTransfer versions through 1.1.0. The issue arises in the template rendering component, specifically within an unknown function of the file '/settings/template'. The vulnerability allows attackers to manipulate the 'template' parameter, bypassing path validation and authentication, to write malicious Nunjucks template code that is later executed on the server.
It is recommended to authenticate the '/settings/template' endpoint, sanitize the 'template' path to prevent path traversal, restrict the content of templates to disallow dangerous Nunjucks features, and upgrade to a patched version once available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xgh0stri13y/CVE-2026-109519/ | [email protected] | |
| https://github.com/0xgh0stri13y/CVE-2026-109519/blob/main/POC/exploit.py | [email protected] | Exploit |
| https://vuldb.com/cve/CVE-2026-109519 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/983611 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417175 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417175/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YouTransfer | <= 0.0.7 (semver) <= 1.0.6 (semver) <= 1.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |