A server side template injection flaw (CWE-94) in the custom template export function of yeti-platform yeti allows an attacker to inject malicious template content, which is then rendered and executed on the application server. This leads to code execution under the privileges of the web process, enabling full compromise of confidentiality and integrity of data stored on or processed by the server.

Versions of yeti-platform yeti before 2.1.12 are impacted. No vendor or product names are available from the CNA; the flaw resides entirely within the application code of this platform.

The CVSS score of 7.3 indicates high severity, while the EPSS score of < 1% suggests a low probability of exploitation. This combination of high severity but low exploitation likelihood means the vulnerability permits remote code execution and is nevertheless considered a high risk threat. It is not listed in the CISA KEV catalog. The likely attack vector involves any user who can trigger the export function—either authenticated or unauthenticated depending on the platform’s access controls. Exploitation would require the attacker to supply crafted template data to the export endpoint, causing the server to evaluate and run that code.