CVE-2021-47749CWE-22

YouPHPTube <= 7.8 - Directory Traversal

High · published January 13, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP files outside the intended directory by using directory traversal sequences.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01828 · 78.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-13T22:51Z
EPSS history
Timeline
  • 13 JAN 22:51Z
    YouPHPTube <= 7.8 - Directory Traversal
    cvelistv5