CVAT CVE-2026-65986

Exploitation requires an authenticated CVAT account with permission to upload annotation guide assets - specifically, write access to the /api/assets endpoint for at least one project or job guide (PR:L). The attacker must be able to set an arbitrary Content-Type in a multipart upload request, which is standard HTTP client behavior. A separate victim with guide-viewing permissions must access the annotation guide containing the malicious asset (UI:P), triggering their browser to fetch and render the file. Limiting factors: (1) pre-authentication exploitation is not possible; (2) the victim must actively navigate to and load the affected guide page; (3) in deployments where all users hold equivalent trust (e.g., single-organization internal tools), the threat model is reduced but not eliminated - a compromised low-privilege account can still target admins. No non-default configuration setting is required; any CVAT instance in the affected version range with annotation guide asset upload enabled is vulnerable.

The CVSS 4.0 score of 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) reflects a realistic attack profile: network-accessible, low attacker privilege (authenticated upload capability), and passive victim interaction required. High confidentiality and integrity impact in the vulnerable system context corresponds to full JavaScript execution in the victim's browser, enabling session token theft or account takeover. The PR:L requirement is a meaningful limiting factor - exploitation is not pre-authentication, so mass opportunistic exploitation is unlikely. No EPSS data was provided, and the CVE is absent from CISA KEV, meaning active exploitation is not confirmed. Real-world risk is moderate-to-high in multi-tenant or collaborative annotation platforms where annotators, reviewers, and admins share project guides, but substantially lower in single-user or air-gapped deployments. The absence of an availability impact (VA:N) and no subsequent-system scope (SC/SI/SA:N) suggests the attacker's blast radius is bounded to the victim's session rather than server-side compromise.

An authenticated annotator uploads a file named 'guide-cover.gif' to a shared annotation guide project but sets the multipart Content-Type field to 'text/html' with an embedded JavaScript payload (e.g., a cookie-stealing script). When a project admin or peer annotator opens the annotation guide and the browser fetches the asset, CVAT serves it with Content-Type: text/html, causing the browser to execute the script and silently exfiltrate the victim's session token to an attacker-controlled server. No public proof-of-concept code has been identified, but the attack technique is well-understood and trivially constructable from the patch diff alone.