A low‑privileged authenticated user can create an ExportTask with a name that includes traversal sequences, causing Yeti to generate a file name from the task name and store it in a local backend without sanitisation. The attacker can then read or write arbitrary files on the host that the Yeti service account can access, which may include sensitive configuration files or data. Though the CVE does not establish universal code execution, the ability to read or modify critical files presents a serious confidentiality and integrity risk, reflected in the CVSS score of 8.3.

Yeti Platform "YETI" users running versions prior to 2.5.1 are affected. The vulnerability exists in the core/clients/file_storage component where ExportTask.file_name is derived from the user supplied task name and is passed to local_storage without path confinement.

The exploit requires only a valid user account with access to the default local storage backend, so the attack vector is authenticated local. No specific elevation of privilege is required, but the damage depends on the file system permissions of the Yeti service account. Because the EPSS score is not available and the issue is not listed in the CISA KEV catalog, no publicly known exploits are currently documented. Nonetheless, the high CVSS score and the ability to read/write arbitrary files make this a high‑risk vulnerability that should be addressed promptly.