CVE-2024-46507

HighCVSS 7.3

Published: 08/05/2026(UTC)Updated: 28/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

3.92%

90th percentile - higher than 90% of all known CVEs

Summary

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform before version 2.1.12 allows attackers to execute code on the application server.

Risk Assessment

This vulnerability could lead to remote code execution, posing a serious threat to the integrity and security of the system.

Recommendation

It is recommended to upgrade to version 2.1.12 or later to mitigate this vulnerability.

Other vulnerabilities in yeti-platform

CVE-2024-46508High
In versions of yeti-platform before 2.1.12, attackers can generate valid JWT tokens if the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).

Original NVD description (English source)

A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS