CVE-2026-63502

Name of the Vulnerable Software and Affected Versions Yeti versions prior to 2.5.1

Description An issue exists where the software derives ExportTask.file name from a user-controlled task name and passes it to core/clients/file storage/classes/local storage.py without sanitizing traversal sequences or enforcing path confinement. A low-privileged authenticated user utilizing the default local storage backend can exploit this via the 'POST /api/v2/tasks/export/new' endpoint by providing a traversal name. Subsequently, the user can read files accessible to the service account through the 'GET /api/v2/tasks/export/{export id}/content' endpoint. Additionally, executing the ExportTask.run() function allows writing attacker-controlled export output to a selected writable path. The overall impact is determined by the filesystem permissions of the service account.

Recommendations Update to version 2.5.1.