Yeti Platform < 2.1.12 - Server-Side Template Injection to RCE
The Yeti Platform < 2.1.12 contains a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) when exploited by an authenticated user. Attackers with valid credentials can inject malicious template expressions, which the server evaluates, allowing arbitrary command execution.
PoC 已收录Yeti
CVSS—