The vulnerability is a PHP file inclusion flaw that allows an unauthenticated attacker to construct a request path containing directory traversal sequences. The underlying OWASP CWE-98 weakness bypasses input sanitization, enabling the attacker to include a local PHP file that already exists on the server. If such a file is uploaded or present through other means, its code will execute within the YOURLS web process, providing complete control over the application scope. The impact is therefore remote code execution, which compromises confidentiality, integrity, and availability of the web process and any underlying data.

YOURLS, a self-hosted URL shortener written in PHP, is affected in all releases prior to 1.10.5. The flaw resides in the yourls_get_request function, and the included files are resolved under the YOURLS_PAGEDIR directory. No specific patch version beyond 1.10.5 is required; any version earlier than that remains vulnerable.

The CVSS score of 5.3 indicates moderate severity, but the attack surface is broad: an unauthenticated external request can trigger the flaw. EPSS score of < 1% indicates a very low probability of exploitation at the present time, and the vulnerability is not listed in CISA KEV. Because the flaw allows arbitrary file inclusion without authentication or file permission checks, an attacker with network connectivity to the application can invoke the inclusion by crafting a request path. The ease of triggering it from any external client suggests a potential risk, but the low EPSS score indicates the current exploitation likelihood remains low.