CVE-2026-109519: YouTransfer Template Rendering template path traversal
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
YouTransfer deployments running versions up to 0.0.7, 1.0.6, or 1.1.0 should be prioritized. The vulnerable functionality is associated with the /settings/template endpoint and Template Rendering component.
Does exploitation require authentication or user interaction?
The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The issue can be launched remotely.
Is public exploitation material available?
Yes. The exploit is described as public and potentially usable, so exposed instances should be treated as having elevated exploitation risk.
Is a vendor fix or response identified?
No vendor response is reported in the available information, and no fixed version or mitigation is provided. If patching cannot be confirmed, restrict network access to the affected service and especially the /settings/template functionality where feasible.