Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63489— Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

Quick assessment

Affected
yeti-platform yeti
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yeti 通过提供取证情报平台及数据流水线，弥合了威胁情报（CTI）与数字取证及事件响应（DFIR）从业者之间的鸿沟。在 2.5.0 及更早版本中，YETI 在 文件中，将用户可控的排序字段以及 属性路径直接内插（interpolate）到 ArangoDB 的 AQL 标识符和表达式位置。低权限的已认证用户可向以下接口发送特制参数： 、 、 、 、 或 ，从而导致攻击者控制的 AQL 子表达式被解析并执行。 该漏洞可能带来以下风险：提供错误信息反馈（error oracle）、针对内部集合（如用户集合）执行表达式

CVSS 7.6 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
yeti-platform yeti <= 2.5.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63489

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters
Source: CVE Program / CVE List V5
Vulnerability Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL identifier and expression positions in core/database_arango.py. A low-privileged authenticated user can send crafted values to POST /api/v2/observables/search, POST /api/v2/entities/search, POST /api/v2/indicators/search, POST /api/v2/dfiq/search, POST /api/v2/search/, or POST /api/v2/graph/search, causing attacker-controlled AQL subexpressions to be parsed and evaluated. This can provide an error oracle, evaluate expressions against internal collections such as users, alter intended search logic, enumerate schema information, and consume excessive database resources. The verified injection points are read and search contexts, so arbitrary database writes are not established. No fixed version is available as of this review.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
数据查询逻辑中特殊元素的不当中和
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
yeti-platform yeti <= 2.5.0 -

II. Public POCs for CVE-2026-63489

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63489

请登录查看更多情报信息。

Other References for CVE-2026-63489 (4)

Same Patch Batch · yeti-platform · 2026-11-03 · 4 CVEs total

CVE-2026-63502 8.3 HIGH Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write
CVE-2026-63482 7.5 HIGH Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
CVE-2026-63500 7.1 HIGH Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive

IV. Related Vulnerabilities

Same product: yeti
Same vendor: yeti-platform
Same weakness: CWE-943