CVE-2026-63502— Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write

Quick assessment

Affected

yeti-platform yeti

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Yeti 通过提供取证情报平台及处理流水线，弥合了威胁情报（CTI）与数字取证与事件响应（DFIR）从业人员之间的差距。在 2.5.1 版本之前，YETI 会从用户可控的任务名称中导出，并在未对路径遍历序列进行过滤、也未强制实施路径限制的情况下，将其传递给。若使用默认的本地存储后端，低权限的已认证用户可通过向发送包含路径遍历字符的任务名称，随后利用接口读取，从而访问 YETI 服务账户有权读取的文件。此外，执行还可将攻击者控制的导出结果写入到攻击者指定的可写路径中。该漏洞的影响程度取决于 YETI

CVSS 8.3 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1565.003 · Runtime Data Manipulation T1565.001 · Stored Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write

Source: CVE Program / CVE List V5

Vulnerability Description

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
yeti-platform	yeti	<= 2.5.0	-

II. Public POCs for CVE-2026-63502

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63502

请登录查看更多情报信息。

Other References for CVE-2026-63502 (4)

https://github.com/yeti-platform/yeti/pull/1280 x_refsource_MISC
https://github.com/yeti-platform/yeti/releases/tag/2.5.1 x_refsource_MISC
https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq x_refsource_CONFIRM
https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63502

Same Patch Batch · yeti-platform · 2026-11-03 · 4 CVEs total

CVE-2026-63489	7.6 HIGH	Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parame
CVE-2026-63482	7.5 HIGH	Yeti: Unauthenticated Access to Full Audit Timeline Discloses All Threat Intelligence Data
CVE-2026-63500	7.1 HIGH	Yeti: Path traversal in DFIQ uuid allows authenticated arbitrary file write during archive

IV. Related Vulnerabilities

Same product: yeti

Same vendor: yeti-platform

Same weakness: CWE-22