# CVE-2024-46507: A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti…

Source: https://junglewise.ai/threats/cve-2024-46507-a-ssti-server-side-template-injection-vulnerability-in-the-custom  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08  
License: CC BY 4.0 with a link back

CVE-2024-46507 · Severity: high · CVSS 7.3 · Published 2026-05-08

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.

Technologies: [Yeti-Platform Yeti](https://junglewise.ai/threats/technologies/yeti-platform-yeti). Vendors: [Yeti-Platform](https://junglewise.ai/threats/vendors/yeti-platform).

## Quick answers

**Is CVE-2024-46507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-46507 being exploited in the wild.

**How severe is CVE-2024-46507?** High severity, with a CVSS score of 7.3, published 8 May 2026.

**Which products and versions are affected?** Yeti-Platform Yeti. The advisory does not name versions.

**Is there a fix for CVE-2024-46507?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2024-46507?** Check whether you run Yeti-Platform Yeti. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Yeti-Platform Yeti

## Related threats

- [Yeti ExportTask path traversal in file storage](https://junglewise.ai/threats/cve-2026-63502-yeti-bridges-the-gap-between-cti-and-dfir-practitioners-by)
- [Yeti path traversal in DFIQ UUID archive export](https://junglewise.ai/threats/cve-2026-63500-yeti-bridges-the-gap-between-cti-and-dfir-practitioners-by)
- [yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by…](https://junglewise.ai/threats/cve-2024-46508-yeti-platform-yeti-before-2-1-12-allows-attackers-to-generate)