CVE-2021-47899CWE-434

YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability

Medium · published January 23, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote file upload feature. Attackers can exploit the url parameter in the url_upload_handler endpoint to access sensitive files like /etc/passwd by using file:/// protocol.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00301 · 21.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-01-23T16:47Z
EPSS history
Timeline
  • 23 JAN 16:47Z
    YetiShare File Hosting Script 5.1.0 Remote File Upload SSRF Vulnerability
    cvelistv5