yeti-platform Yeti up to 2.5.0 Local Storage Backend local_storage.py ExportTask.run path traversal

Summaryinfo

A vulnerability was found in yeti-platform Yeti up to 2.5.0 and classified as critical. The affected element is the function ExportTask.run of the file core/clients/file_storage/classes/local_storage.py of the component Local Storage Backend. Executing a manipulation can lead to path traversal. This vulnerability is handled as CVE-2026-63502. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in yeti-platform Yeti up to 2.5.0 and classified as critical. This vulnerability affects the function ExportTask.run of the file core/clients/file_storage/classes/local_storage.py of the component Local Storage Backend. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.

The advisory is available at github.com. This vulnerability was named CVE-2026-63502 since 07/16/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 2.5.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• yeti-platform

Name

• Yeti

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.0

Website

• Product: https://github.com/yeti-platform/yeti/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion