A flaw in YouTransfer’s Template Rendering component permits an attacker to execute a path traversal by manipulating an unknown function in the /settings/template endpoint. This conditional flaw can be triggered remotely to cause the application to read files outside the intended template directory, thereby exposing sensitive data. The vulnerability is identified as a CWE‑22 path traversal weakness, threatening the confidentiality of all files accessible to the web server’s process.

The vulnerability affects YouTransfer releases 0.0.7, 1.0.6, and 1.1.0. The known issue resides in the Template Rendering module, meaning any deployments of these versions are potentially compromised. No later releases are mentioned in the available information, so the vendor’s response or patch status remain unknown.

The CVSS score of 6.9 denotes medium severity. EPSS is not available and the flaw is not listed in the CISA KEV catalog. Because the exploit is publicly available and can be performed remotely through an HTTP request, the likelihood of real‑world exploitation is moderate to high. In the absence of an official patch, affected parties must act immediately to contain the risk.