Is CVE-2026-63502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63502 being exploited in the wild.

How severe is CVE-2026-63502?

High severity, with a CVSS score of 8.3, published 3 November 2026.

Which products and versions are affected?

Yeti-Platform Yeti prior to 2.5.1.

Is there a fix for CVE-2026-63502?

Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63502 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63502?

Check whether you run Yeti-Platform Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63502: Yeti ExportTask path traversal in file storage

CVE-2026-63502 · Severity: high · CVSS 8.3 · Published 2026-11-03

YETI is a forensic intelligence platform used by security teams to correlate threat data. A low-privileged authenticated user can exploit inadequate path validation in the export feature to read arbitrary files from the server or write malicious content to unintended locations, depending on the service account's filesystem permissions. This could expose sensitive investigation data or system files.

Technologies: Yeti-Platform Yeti. Vendors: Yeti-Platform.

Quick answers

Is CVE-2026-63502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63502 being exploited in the wild.
How severe is CVE-2026-63502?: High severity, with a CVSS score of 8.3, published 3 November 2026.
Which products and versions are affected?: Yeti-Platform Yeti prior to 2.5.1.
Is there a fix for CVE-2026-63502?: Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63502 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63502?: Check whether you run Yeti-Platform Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.5.1

Technical details

The vulnerability is a path traversal flaw in ExportTask.file_name derivation: user-controlled task names are insufficiently sanitized (only spaces removed) before being passed to the local storage backend. An authenticated attacker can inject traversal sequences like ../../../../etc/passwd and use POST /api/v2/tasks/export/new and GET /api/v2/tasks/export/{export_id}/content endpoints to read files, or call ExportTask.run() to write output to arbitrary writable paths accessible to the YETI service account. The fix applies strict character allowlisting to file names and adds path confinement validation in LocalStorageClient._file_path().

Affected products

yeti-platform YETI prior to 2.5.1

Timeline

2026-11-03: disclosed
2026-07-01: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.