{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63502","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-16T21:49:52.069Z","datePublished":"2026-11-03T19:36:06.607Z","dateUpdated":"2026-11-03T19:36:06.607Z"},"containers":{"cna":{"title":"Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write","problemTypes":[{"descriptions":[{"cweId":"CWE-22","lang":"en","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"}}],"references":[{"name":"https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq","tags":["x_refsource_CONFIRM"],"url":"https://github.com/yeti-platform/yeti/security/advisories/GHSA-4q3w-w2g5-8wqq"},{"name":"https://github.com/yeti-platform/yeti/pull/1280","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/pull/1280"},{"name":"https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a"},{"name":"https://github.com/yeti-platform/yeti/releases/tag/2.5.1","tags":["x_refsource_MISC"],"url":"https://github.com/yeti-platform/yeti/releases/tag/2.5.1"}],"affected":[{"vendor":"yeti-platform","product":"yeti","versions":[{"version":"<= 2.5.0","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-03T19:36:06.607Z"},"descriptions":[{"lang":"en","value":"Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user using the default local storage backend can call POST /api/v2/tasks/export/new with a traversal name and use ExportTask.file_contents through GET /api/v2/tasks/export/{export_id}/content to read files accessible to the YETI service account. Running ExportTask.run() can also write attacker-controlled export output to an attacker-selected writable path. The impact depends on the service account's filesystem permissions, and universal code execution is not established. This issue is fixed in version 2.5.1."}],"source":{"advisory":"GHSA-4q3w-w2g5-8wqq","discovery":"UNKNOWN"}}}}