CVE-2026-50880: YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution

June 15, 2026 (updated August 26, 2026)

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

References

gist.github.com/pyuysig/4013f4f10f74b3fded7ddf41b6d36ae5
github.com/advisories/GHSA-68mc-h6h8-79wj
nvd.nist.gov/vuln/detail/CVE-2026-50880

Code Behaviors & Features

Detect and mitigate CVE-2026-50880 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →