CVE-2026-109519: medium-severity vulnerability in YouTransfer
YouTransfer Template Rendering template path traversal
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.7%
from disclosure to weapon0 days
Published on NVDOct 13
1st PoCSep 16
exploitation probability
0.7%top 47% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X
Affected products
n/a · YouTransferpublic PoCs found — 2
githubgithub.com/0xgh0stri13y/CVE-2026-109519★ 0cve_referencegithub.com/0xgh0stri13y/CVE-2026-109519/blob/main/POC/exploit.pyunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.