EUVD-2026-52892Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible requiring low privileges (cloud storage write or add-storage permission); no confidentiality or availability impact, only high-integrity arbitrary file overwrite within the vulnerable system.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
AnalysisAI
Path traversal in CVAT versions 1.6.0 through 2.64.0 enables an authenticated, low-privileged attacker with write access to an integrated cloud storage - or permission to add new cloud storage integrations - to overwrite arbitrary files on the server filesystem by embedding traversal sequences in cloud storage file paths processed by the application. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VI:H) confirms network-accessible, low-complexity exploitation requiring only low-privilege access with high integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires one of two conditions: (a) the attacker already has write access to a cloud storage bucket (e.g., AWS S3, Azure Blob, Google Cloud Storage) that has been integrated into the CVAT instance, allowing them to plant a malicious manifest; or (b) the attacker holds CVAT account permissions sufficient to add new cloud storage integrations, enabling them to register an attacker-controlled bucket. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VI:H accurately captures the real-world risk profile: the attack is network-accessible with low complexity and requires no user interaction, but does require low-privileged access - specifically, the ability to write to an attached cloud storage or to configure a new one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to an S3 bucket linked to a CVAT instance uploads a crafted manifest file whose entries contain path traversal sequences such as '../../etc/cron.d/backdoor'. When a CVAT server process - such as backup import or cache population - reads this manifest and constructs destination paths using os.path.join without sanitization, it writes attacker-controlled file content to the traversed location outside the intended storage directory. … |
| Remediation | The primary fix is upgrading CVAT to version 2.65.0 or later, which introduces strict path sanitization via the new join_untrusted_path and problem_with_untrusted_path utilities that reject path components containing '..', '.', empty segments, or leading slashes across all affected endpoints. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all CVAT deployments to identify vulnerable versions (1.6.0-2.64.0) and immediately restrict cloud storage write permissions to only essential administrators; disable new cloud storage integration capabilities where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a
Stored cross-site scripting in CVAT (Computer Vision Annotation Tool) versions 2.5.0 through 2.63.0 allows an authentica
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide ed
Cross-organization report enumeration in CVAT before 2.69.0 exposes the existence of quality reports belonging to other
Broken object-level authorization in CVAT's lambda annotation API allows authenticated Worker-role users to exploit pred
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today