CVE-2026-63502 Details
Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.
A path traversal vulnerability has been identified in Yeti versions prior to 2.5.1. The issue arises in the ExportTask component, where the task name provided by the user is used to generate the export file name without proper sanitization. This allows low-privileged authenticated users to manipulate the file name and traverse the file system, accessing files readable by the Yeti service account. Additionally, the vulnerability can be exploited to write data to arbitrary locations outside the designated export directory, depending on the service account's file system permissions.
Users are advised to update to Yeti version 2.5.1 or later, where this vulnerability has been fixed. For those using earlier versions, it is recommended to manually sanitize task names to remove path traversal sequences and enforce path confinement before using them as file storage keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/pull/1280 | [email protected] | Source CodeVendor |
| https://github.com/yeti-platform/yeti/releases/tag/2.5.1 | [email protected] | Release NotesVendor |
| https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Yeti | <= 2.5.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |