PT-2026-4515 · Unknown · Yetishare File Hosting Script

Numan Türle · Publicado 2026-01-23 · Atualizado 2026-01-24 · CVE-2021-47899

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions YetiShare File Hosting Script version 5.1.0

Description The software contains a server-side request forgery condition that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the /url upload handler API endpoint to access sensitive files, such as /etc/passwd, by using the file:/// protocol.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the /url upload handler API endpoint. Avoid using the url parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-47899

Produtos afetados

Yetishare File Hosting Script

Referências · 7

• 🔥 https://exploit-db.com/exploits/49534 · Exploit
• https://t.me/CVEtracker/42863 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2014995831972381166 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2021-47899 · Nota de Segurança
• https://vulncheck.com/advisories/yetishare-file-hosting-script-remote-file-upload-ssrf-vulnerability · Nota
• https://yetishare.com · Nota
• https://mfscripts.com · Nota