Read the docs
TI-2026-84497 Aliases CVE-2026-63502

Path traversal in Yeti export task names allows file read and write

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Yeti through 2.5.0 builds export file paths from the user-controlled ExportTask name without removing traversal sequences (CWE-22). An authenticated user with low privileges can read files the YETI service account can access when the default local storage backend is used, and can write export output to a chosen writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.

Why it matters now

EPSS 0.00412 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
yeti-platformyetiup to 2.5.0—No fix listedCNA
  • yeti Vendoryeti-platform Affected up to 2.5.0 Fixed in — No fix listed CNA

Remediation

Upgrade yeti to version 2.5.1, which the source description states fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63502
  2. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2024-31003 yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the… CVSS 3.1HIGH 7.5
  • TI-2026-62524 Yeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion CVSS 4.0HIGH 7.2
  • TI-2024-31002 A SSTI (server side template injection) vulnerability in the custom template export… CVSS 3.1HIGH 7.3
  • TI-2026-84493 Missing authentication in Yeti exposes full audit timeline CVSS 3.1HIGH 7.5
  • TI-2024-30461 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack CVSS 3.1HIGH 7.5
  • TI-2026-84494 AQL injection in Yeti search sorting and filter parameters CVSS 3.1HIGH 7.6
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences