Executive brief
YouTransfer is a file transfer application that sends files via email using configurable mail transport settings. An authenticated attacker who can modify email transport settings can inject arbitrary system commands through a crafted sender address, leading to remote code execution on the server with YouTransfer process privileges. This affects deployments where untrusted users can access email configuration settings.
Technical details
The vulnerability is a code injection flaw (CWE-94) in YouTransfer's email transport handling. The /settings/email endpoint stores sendmail transport configuration including sendmailPath without proper sanitization. When a transfer is sent via /send, the application passes these attacker-controlled settings to the Nodemailer sendmail transport in lib/youtransfer.js. An attacker with email settings modification privileges can set sendmailPath to an interpreter (e.g., perl) and craft a sender address with command injection payloads (e.g., using perl's -e flag). The vulnerability requires prior authentication and settings modification capability; it is not directly exploitable by unauthenticated users. When the mail transport is invoked, the injected command executes with the privileges of the YouTransfer process. No patch is currently available as of August 2026.
Affected products
- YouTransfer YouTransfer <= 1.0.6
Timeline
- 2026-06-15: disclosed: Published to GitHub Advisory Database
- 2026-06-15: advisory: CVE-2026-50880 assigned