CVE-2026-63135: 
PHP vulnerability analysis and mitigation

CVE-2026-63135 is a stored Cross-Site Scripting (XSS) vulnerability in YOURLS, a self-hosted PHP URL shortener, affecting versions 1.5.1 through 1.10.3. An unauthenticated attacker can poison the referrer statistics of any existing short URL by sending a crafted HTTP Referer header; when an administrator or public stats-page viewer opens the affected statistics page, attacker-controlled JavaScript executes in the YOURLS origin. The vulnerability was discovered by Thai Son Dinh from VinSOC Labs (R&D), published to the GitHub Advisory Database on August 21, 2026, and is fixed in version 1.10.4. It carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the yourls_google_array_to_data_table() function in includes/functions-infos.php, which concatenates referrer domain labels directly into inline Google Charts JavaScript without JavaScript-string escaping (Github Advisory). The full source-to-sink path is: HTTP Referer header → yourls_get_referrer() → yourls_sanitize_url_safe() → yourls_log_redirect() → log table → yourls-infos.php aggregation → yourls_get_domain() → yourls_stats_pie() → yourls_google_array_to_data_table() → inline JavaScript. While yourls_sanitize_url_safe() strips some unsafe characters and CRLF sequences, it permits the characters needed for JavaScript-string breakout — including single quotes ('), brackets ([, ]), commas, and parentheses — allowing a crafted referrer host such as x',1],['marker',alert(1)],['z.tld to survive sanitization and be rendered verbatim into chart JavaScript (Github Advisory). The fix, merged in PR #4107, applies yourls_esc_js() to labels in yourls_google_array_to_data_table() and adds strict hostname validation in yourls_get_domain() (YOURLS PR #4107).

Successful exploitation allows attacker-controlled JavaScript to execute in the browser context of any user who views the affected short URL's statistics page — including authenticated administrators. In private installations, the XSS can be used to read embedded CSRF nonces, call admin AJAX endpoints to create, edit, or delete short URLs, and replace existing short-link destinations with attacker-controlled phishing or malware URLs. The payload can also exfiltrate the victim's secret API signature token from /admin/tools.php, which can then be reused outside the browser session for passwordless API access until the secret is rotated. Confidentiality impact includes exposure of admin-visible URL inventory, long URLs, creator IP addresses, timestamps, click counts, and referrer statistics (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Github Advisory). However, the advisory itself includes a detailed PoC harness demonstrating the full attack path using Docker and Node.js, lowering the barrier for exploitation. The EPSS score is approximately 0.234% (15th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (Github Advisory).

1. Identify a target short URL: Locate any existing short URL on the target YOURLS instance (e.g., http://target.yourls.example/abc). No authentication is required.
2. Craft the malicious Referer header: Construct a Referer header whose host portion breaks out of the JavaScript string context in the Google Charts data table. Example payload:

   Referer: http://x',1],['marker',alert(document.cookie)],['z.tld/path

   This payload is under 200 bytes and survives YOURLS' referrer truncation and sanitization.
3. Poison the statistics: Send an HTTP request to the target short URL with the crafted Referer header:

   curl -H "Referer: http://x',1],['marker',alert(document.cookie)],['z.tld/path" http://target.yourls.example/abc

   YOURLS logs the referrer to its database via yourls_log_redirect().
4. Wait for victim interaction: The payload executes when an administrator or authorized stats-page viewer navigates to the statistics page for the poisoned short URL (e.g., http://target.yourls.example/abc+).
5. Execute privileged actions: Replace alert(document.cookie) with a more sophisticated payload to: steal the API signature token from /admin/tools.php, read CSRF nonces, call admin AJAX endpoints to modify or create short URLs, or exfiltrate session cookies to an attacker-controlled server (Github Advisory).

• Network: Inbound HTTP requests to any short URL endpoint containing unusual characters in the Referer header, particularly single quotes ('), brackets ([, ]), or JavaScript function calls (e.g., alert(, fetch(, XMLHttpRequest).
• Network: Outbound requests from the YOURLS server or from admin browsers to unexpected external domains shortly after a stats page is viewed (potential data exfiltration).
• Logs: Web server access logs showing requests to short URL paths with Referer headers containing JavaScript-like syntax (e.g., '],[', alert(, fetch().
• Logs: YOURLS database log table (yourls_log) containing referrer entries with characters such as ', [, ], or function call patterns in the referrer column.
• Logs: Admin activity logs showing unexpected short URL creation, modification, or deletion events that do not correspond to known administrator actions.
• File System: No file-system artifacts are expected for this XSS-only vulnerability; however, if the XSS is used to deploy a web shell via admin functionality, look for unexpected PHP files in the YOURLS installation directory.

Upgrade YOURLS to version 1.10.4, which applies yourls_esc_js() to all referrer domain labels before embedding them in inline JavaScript, and adds strict hostname character validation in yourls_get_domain() (YOURLS Release 1.10.4, YOURLS PR #4107). As a defense-in-depth measure, deploy a Content Security Policy (CSP) header that restricts inline script execution and limits allowed script sources. If immediate upgrade is not possible, consider restricting access to statistics pages by keeping YOURLS_PRIVATE_INFOS set to true (the default) to limit exposure to authenticated administrators only, and monitor the yourls_log database table for anomalous referrer entries.

The vulnerability was credited to Thai Son Dinh from VinSOC Labs (R&D), with remediation reviewed by dgw and developed by ozh of the YOURLS project (Github Advisory). The fix was merged on May 21, 2026, and the advisory was published on August 21, 2026. The YOURLS 1.10.4 release received positive community reception on GitHub, with multiple contributors reacting with celebratory emoji to the release notes (YOURLS Release 1.10.4). A brief mention was noted on Mastodon via @thehackerwire, and the vulnerability was indexed by threat intelligence aggregators including Tenable and Offseq Radar shortly after disclosure.