CVE-2026-63500

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.5.1

Description A low-privileged authenticated user can exploit a path traversal issue by importing a DFIQ object with a uuid containing traversal sequences via the 'POST /api/v2/dfiq/from yaml' endpoint. The system subsequently interpolates this stored value into an archive filesystem path through the 'POST /api/v2/dfiq/to archive' endpoint. This allows an attacker to write controlled content with a .yaml suffix outside the intended temporary archive directory, limited to paths writable by the YETI service account.

Recommendations Update to version 2.5.1.