CVE-2026-63500— Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export

Quick assessment

Affected

yeti-platform yeti

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yeti 通过提供取证情报平台及处理流程，弥合了威胁情报（CTI）与数字取证与事件响应（DFIR）从业者之间的鸿沟。在 2.5.1 版本之前，会通过接口接收来自 DFIQ YAML 文件的未经验证的 UUID；随后，在接口中将该存储值拼接到归档文件系统路径中。权限较低但已认证的用户可导入一个包含路径遍历序列的 UUID 的 DFIQ 对象，并触发归档导出，导致攻击者控制的内容（以为后缀）被写入到预期的临时归档目录之外。该漏洞的影响范围受限于 YETI 服务账户具有写权限的路径，且独立的 DFIQ 归档导入

CVSS 7.1 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1059.006 · Python T1565.002 · Transmitted Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive export

Source: CVE Program / CVE List V5

Vulnerability Description

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
yeti-platform	yeti	<= 2.5.0	-

II. Public POCs for CVE-2026-63500

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63500

请登录查看更多情报信息。

Other References for CVE-2026-63500 (4)

https://github.com/yeti-platform/yeti/pull/1279 x_refsource_MISC
https://github.com/yeti-platform/yeti/releases/tag/2.5.1 x_refsource_MISC
https://github.com/yeti-platform/yeti/security/advisories/GHSA-6xf2-8436-rgvf x_refsource_CONFIRM
https://github.com/yeti-platform/yeti/commit/8e36bd0000f98f625540e37eeb9f304c684e8394 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63500

Same Patch Batch · yeti-platform · 2026-11-03 · 4 CVEs total

CVE-2026-63502	8.3 HIGH	Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write
CVE-2026-63489	7.6 HIGH	Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parame
CVE-2026-63482	7.5 HIGH	Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data

IV. Related Vulnerabilities

Same product: yeti

Same vendor: yeti-platform

Same weakness: CWE-22