CVE-2026-63500
Deferred Deferred - Pending Action

Path Traversal in Yeti Forensics Intelligence Platform

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py later interpolates that stored value into an archive filesystem path in POST /api/v2/dfiq/to_archive. A low-privileged authenticated user can import a DFIQ object whose UUID contains traversal sequences and trigger archive export, causing attacker-controlled content with a .yaml suffix to be written outside the intended temporary archive directory. The impact is limited by paths writable by the YETI service account, and the separate DFIQ archive-import zip-slip candidate is not part of this vulnerability. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63500
EUVD
EUVD-2026-116268

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeti-platform yeti <= 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Yeti platform before version 2.5.1. It involves improper handling of a UUID input in DFIQ YAML files. An authenticated user with low privileges can import a DFIQ object with a malicious UUID containing path traversal sequences. This UUID is later used to create an archive filesystem path, allowing the attacker to write files with a .yaml extension outside the intended temporary directory.

Detection Guidance

Check Yeti version for vulnerability presence. If version is below 2.5.1, the system is vulnerable. Inspect logs for POST requests to /api/v2/dfiq/from_yaml or /api/v2/dfiq/to_archive with unusual UUID values containing path traversal sequences like '../'.

Impact Analysis

An attacker could write malicious YAML files to arbitrary locations on the system where the Yeti service account has write permissions. This could lead to code execution, data exfiltration, or further compromise of the system, depending on the attacker's goals and the permissions of the Yeti service account.

Mitigation Strategies

Upgrade Yeti to version 2.5.1 or later immediately. Ensure the YETI service account has minimal filesystem permissions. Review and restrict access to DFIQ import/export endpoints. Monitor for unauthorized archive exports or unexpected file writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63500. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...