CVE-2021-47749

YouPHPTube <= 7.8 - Directory Traversal

High8.7Public exploitEPSS 1.8%

Published: 13 Jan 2026
Updated: 14 May 2026
Reserved: 31 Dec 2025
Assigned by: VulnCheck

Description

YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' parameter in GET requests. Attackers can exploit the path traversal flaw in locale/function.php to include and view PHP files outside the intended directory by using directory traversal sequences.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-51101 (opens in a new tab)exploit

Timeline

2025
31 Dec 2025
31 Dec 2025
ID reserved
By VulnCheck
2026
13 Jan 202613 days later
13 Jan 2026· 13 days later
Published
14 May 20264 months later
14 May 2026· 4 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-47749, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified	4.0	High8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 1.8% · top 21% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

YouPHPTube · YouPHPTube
- affected ≤ 7.8

References (3)

ExploitDB-51101 (opens in a new tab)exploit
Archived YouPHPTube Homepage (opens in a new tab)product
VulnCheck Advisory: YouPHPTube <= 7.8 - Directory Traversal (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-47749](https://trackcve.app/badge/CVE-2021-47749.svg)](https://trackcve.app/cve/CVE-2021-47749)

Record last updated 14 May 2026, 02:06 UTC.