CVE-2026-50880: An issue in the sendmail transport integration component of YouTransfer v1

Synopsis

This is a remote code execution vulnerability in the sendmail transport integration component of YouTransfer v1.0.6. The flaw is reachable over the network and requires no authentication or user interaction, meaning any attacker who can reach the service can exploit it by sending a crafted request. Successful exploitation gives the attacker full control over the affected system, including the ability to read, modify, or delete data and run arbitrary commands. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network, so an attacker must be able to reach the service via a network connection to exploit it.

• AuthenticationNot required

  No credentials or session token of any kind are needed; the exploit can be triggered by an unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is entirely server-side.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental prerequisites required.

Blast Radius

• A successful attacker executes arbitrary operating system commands on the host running YouTransfer.
• The attacker reads all data accessible to the process, including stored files, credentials, and configuration secrets.
• The attacker modifies or deletes stored files and application data on the affected host.
• The attacker can crash or permanently disable the YouTransfer service, causing a full denial of file-transfer functionality.