CVE-2026-63502

The Yeti forensics intelligence platform is vulnerable to a path traversal flaw in its ExportTask name prior to version 2.5.1 . The root cause is the lack of sanitization for traversal sequences or path confinement when deriving ExportTask.file_name from user-controlled task names, specifically w...

CVE-2026-63502 Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.filename from the user-controlled task name and passes it to core/clients/filestorage/classes/localstorage.py without sanitizing traversal...