CVE-2026-63500 Details
Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.
A path traversal vulnerability has been identified in Yeti versions prior to 2.5.1. The issue arises in the DFIQ YAML import process, where the application accepts unvalidated UUIDs from the DFIQ YAML into the archive export workflow. This flaw allows low-privileged authenticated users to manipulate UUIDs with traversal sequences, causing attacker-controlled content to be written outside the designated temporary archive directory. The vulnerability is limited to paths that the YETI service account can write to.
Users can update to Yeti version 2.5.1 or later, where this vulnerability has been fixed. For those unable to update, it is recommended to manually validate and sanitize UUID inputs in DFIQ YAML imports, ensuring they conform to proper UUID formats and do not contain traversal sequences. Additionally, avoid directly using UUIDs as path components without thorough validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394 | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/pull/1279 | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/releases/tag/2.5.1 | [email protected] | Release NotesVendor |
| https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yeti | <= 2.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |