This vulnerability involves SSTI in the custom template export feature of yeti-platform prior to version 2.1.12. An attacker can inject malicious template code that the server executes, leading to remote code execution on the application server. The vulnerability is remotely exploitable without authentication and requires low attack complexity. Confidentiality, integrity, and availability impacts are all rated low to medium based on the CVSS vector. No official remediation or patch information is available, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary code on the server hosting the vulnerable yeti-platform application. This can lead to unauthorized access, data compromise, and potential disruption of service. The CVSS score of 7.3 reflects a high severity with impacts on confidentiality, integrity, and availability, though no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround is documented, users should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable functionality and applying application-level input validation may reduce exposure.