Yeti-platform vulnerabilities
We track 8 vulnerabilities in Yeti-platform products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest Yeti-platform vulnerabilities
- 8.3 High severity
yeti: Improper Limitation of a Pathname to a Restricted Directory
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_storage/classes/local_s
- 7.1 High severity
yeti: Improper Limitation of a Pathname to a Restricted Directory
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, core/schemas/dfiq.py accepts an unvalidated uuid from DFIQ YAML through POST /api/v2/dfiq/from_yaml, and core/web/apiv2/dfiq.py
- 7.6 High severity
yeti: Improper Neutralization of Special Elements in Data Query Logic
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filter_aliases attribute paths into ArangoDB AQL id
- 7.5 High severity
yeti: Missing Authentication for Critical Functionality
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI registers the audit router without Depends(auth.get_current_active_user), and core/web/apiv2/audit.py does not perform a r
- 8.1 High severity
yeti: Missing Authorization
Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control relationships. Attackers can revoke the owner's grant and permanently lock legitimate owners out of obje
- 7.5 High severity
Yeti: Use of Hard-coded Credentials
yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).
- 7.3 High severity
Yeti: Improper Control of Generation of Code
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.
- 7.5 High severity
yeti: Allocation of Resources Without Limits or Throttling
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly