CVE-2026-63502
Deferred Deferred - Pending Action

Path Traversal in YETI Forensics Intelligence Platform

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: GitHub, Inc.

Description
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-63502
EUVD
EUVD-2026-116266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
yeti-platform yeti <= 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a path traversal vulnerability in the YETI platform (versions up to 2.5.0) where an authenticated user can manipulate export task file names to read or write arbitrary files accessible by the YETI service account. The issue occurs because user-controlled task names are used directly as file names without sanitization, allowing sequences like ../../../../etc/passwd to traverse directories.

Detection Guidance

Check YETI version for versions prior to 2.5.1. Monitor API logs for POST /api/v2/tasks/export/new and GET /api/v2/tasks/export/{export_id}/content requests containing path traversal sequences like ../../../../. Test with crafted task names containing traversal sequences to see if files outside the storage directory are accessible.

Impact Analysis

An attacker with low privileges can read sensitive files (e.g., configuration files, credentials) accessible to the YETI service account or write malicious export output to arbitrary writable paths. The impact depends on the service account's filesystem permissions but could lead to data exposure or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (e.g., personal health information under HIPAA or personal data under GDPR), resulting in compliance violations, data breaches, and potential legal penalties due to compromised confidentiality and integrity of stored information.

Mitigation Strategies

Upgrade YETI to version 2.5.1 or later. Ensure task names are sanitized to remove path traversal sequences. Verify the local storage backend enforces path confinement. Restrict permissions of the YETI service account to minimize filesystem access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63502. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...