CVE-2026-63489

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.5.1

Description An issue exists where user-controlled sorting fields and filter aliases attribute paths are directly interpolated into ArangoDB AQL identifier and expression positions within core/database arango.py. A low-privileged authenticated user can exploit this by sending crafted values to the following API endpoints:

This allows attacker-controlled AQL subexpressions to be parsed and evaluated, which can lead to the use of an error oracle, evaluation of expressions against internal collections like users, alteration of search logic, enumeration of schema information, and excessive consumption of database resources. The issue is limited to read and search contexts, meaning arbitrary database writes are not possible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.