# CVE-2026-63502: Yeti ExportTask path traversal in file storage

Source: https://junglewise.ai/threats/cve-2026-63502-yeti-bridges-the-gap-between-cti-and-dfir-practitioners-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-63502 · Severity: high · CVSS 8.3 · Published 2026-11-03

YETI is a forensic intelligence platform used by security teams to correlate threat data. A low-privileged authenticated user can exploit inadequate path validation in the export feature to read arbitrary files from the server or write malicious content to unintended locations, depending on the service account's filesystem permissions. This could expose sensitive investigation data or system files.

Technologies: [Yeti-Platform Yeti](https://junglewise.ai/threats/technologies/yeti-platform-yeti). Vendors: [Yeti-Platform](https://junglewise.ai/threats/vendors/yeti-platform).

## Quick answers

**Is CVE-2026-63502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63502 being exploited in the wild.

**How severe is CVE-2026-63502?** High severity, with a CVSS score of 8.3, published 3 November 2026.

**Which products and versions are affected?** Yeti-Platform Yeti prior to 2.5.1.

**Is there a fix for CVE-2026-63502?** Yes: fixed in 2.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63502 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-63502?** Check whether you run Yeti-Platform Yeti at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.1

## Technical details

The vulnerability is a path traversal flaw in ExportTask.file_name derivation: user-controlled task names are insufficiently sanitized (only spaces removed) before being passed to the local storage backend. An authenticated attacker can inject traversal sequences like ../../../../etc/passwd and use POST /api/v2/tasks/export/new and GET /api/v2/tasks/export/{export_id}/content endpoints to read files, or call ExportTask.run() to write output to arbitrary writable paths accessible to the YETI service account. The fix applies strict character allowlisting to file names and adds path confinement validation in LocalStorageClient._file_path().

## Affected products

- yeti-platform YETI prior to 2.5.1

## Timeline

- 2026-11-03: disclosed
- 2026-07-01: patched

## References

- [https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a](https://github.com/yeti-platform/yeti/commit/bfd7c2424dc05dea2d46b5b106b5071f959d5d5a)
- [https://github.com/yeti-platform/yeti/pull/1280](https://github.com/yeti-platform/yeti/pull/1280)

## Related threats

- [Yeti path traversal in DFIQ UUID archive export](https://junglewise.ai/threats/cve-2026-63500-yeti-bridges-the-gap-between-cti-and-dfir-practitioners-by)
- [yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by…](https://junglewise.ai/threats/cve-2024-46508-yeti-platform-yeti-before-2-1-12-allows-attackers-to-generate)
- [A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti…](https://junglewise.ai/threats/cve-2024-46507-a-ssti-server-side-template-injection-vulnerability-in-the-custom)