Yeti: Path traversal remote file write (CVE-2026-63500)
An authenticated low-privileged user can exploit a path traversal vulnerability in the Yeti Forensics Intelligence platform to write content with a .yaml suffix outside the intended archive directory.
CVE search metadata
CVE search record: CVE-2026-63500. Severity: high. CVSS: 7.1. KEV: no. Product: Yeti (< 2.5.1). Brief: Yeti: Path traversal remote file write (CVE-2026-63500). Brief link: https://feed.craftedsignal.io/briefs/2026-11-yeti-path-traversal/
Triage facts
Revision 1- Applicability
- Yeti (< 2.5.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 22:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Yeti versions prior to 2.5.1 allow an authenticated low-privileged user to import a DFIQ object via POST /api/v2/dfiq/from_yaml with a UUID containing traversal sequences. This value is later interpolated into a filesystem path in POST /api/v2/dfiq/to_archive, resulting in arbitrary file writes limited by the permissions of the Yeti service account.