Yeti Platform versions prior to 2.5.1 allowed a low‑privileged authenticated user to import a DFIQ object containing a UUID with directory‑traversal sequences. During the archive export process that UUID is interpolated into a filesystem path, permitting the attacker‑controlled content to be written outside the temporary archive directory. The effect is limited to paths writable by the service account, but the attacker can create or overwrite files with a .yaml suffix, potentially embedding malicious data into the system.

The vulnerability is present in Yeti Platform Yeti before the 2.5.1 release. It affects the core/schemas/dfiq.py module that parses unvalidated UUIDs from DFIQ YAML objects and the core/web/apiv2/dfiq.py endpoint that expands those UUIDs into archive export paths.

The CVSS score of 7.1 indicates a high severity vulnerability, though a valid exploit requires authentication through the API. EPSS is not available and the issue is not listed in CISA KEV. Because the attacker can only write files in directories writable by the YETI service account, the risk is significant but constrained to the service account’s permissions. The exposed path traversal could enable an attacker to introduce arbitrary configuration files or trigger further attacks if the service account or other components process those files. The fix in version 2.5.1 removes the unvalidated UUID handling and mitigates the path traversal risk.