Read the docs
TI-2026-84495 Aliases CVE-2026-63500

Path traversal in Yeti DFIQ export allows arbitrary file writes

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Yeti through 2.5.0 is affected. The uuid of an imported DFIQ YAML object is not validated, so traversal sequences in it reach an archive filesystem path (CWE-22). An authenticated low-privileged user can import a crafted DFIQ object and trigger archive export to write attacker-controlled content outside the temporary archive directory, limited to paths the YETI service account can write. The flaw is not listed in CISA KEV and no public exploit is linked.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yeti-platformyetiup to 2.5.0—No fix listedCNA
  • yeti Vendoryeti-platform Affected up to 2.5.0 Fixed in — No fix listed CNA

Remediation

Upgrade Yeti to version 2.5.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63500
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2024-31003 yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the… CVSS 3.1HIGH 7.5
  • TI-2026-62524 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion CVSS 4.0HIGH 7.2
  • TI-2024-31002 A SSTI (server side template injection) vulnerability in the custom template export… CVSS 3.1HIGH 7.3
  • TI-2026-84493 Missing authentication in Yeti exposes full audit timeline CVSS 3.1HIGH 7.5
  • TI-2026-84497 Path traversal in Yeti export task names allows file read and write CVSS 3.1HIGH 8.3
  • TI-2024-30461 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences