EUVD-2025-28282Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a user role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
Analysis
CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import process of a project or task backup to check that the filename specified in the query parameter refers to a TUS-uploaded file belonging to the same user. As a result, if an attacker with a CVAT account and a user role knows the filenames of other users' uploads, they could potentially access and steal data by creating projects or tasks using those files. This issue does not affect annotation or dataset TUS uploads, since in this case object-specific temporary directories are used. Users should upgrade to CVAT 2.40.0 or a later version to receive a patch. No known workarounds are available.
Technical ContextAI
This vulnerability is classified as Authorization Bypass Through User-Controlled Key (CWE-639).
RemediationAI
A vendor patch is available. Apply it as soon as possible and verify the fix.
Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVAT is an opensource interactive video and image annotation tool for computer vision. Rated critical severity (CVSS 9.8
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 8.8 HIGH]
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
CVAT is an open source interactive video and image annotation tool for computer vision. [CVSS 5.4 MEDIUM]
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated medi
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. Rated high
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today