Executive brief
CVAT is an open-source annotation tool used for labeling images and videos for machine learning projects. An attacker with write access to a connected cloud storage account, or who can add new cloud storage credentials to a CVAT instance, can overwrite arbitrary files on the server—potentially compromising application integrity, injecting malicious code, or corrupting critical system files.
Technical details
The vulnerability consists of multiple path traversal flaws in CVAT versions 1.6.0 through 2.64.0. An attacker can inject path traversal sequences (e.g., `../../foo/bar`) via cloud storage manifests, the `manifest_path` parameter in the contents-v2 endpoint, or the `server_files` parameter when creating tasks from cloud storage. These paths escape the intended storage directory and allow overwriting files anywhere on the server filesystem. The attack requires either write access to an already-configured cloud storage or the ability to add new cloud storage accounts to the CVAT instance (typically requiring some level of authentication). The fix in version 2.65.0 implements systematic path validation and verification that all externally-supplied paths remain within their intended root directories after joining.
Affected products
- CVAT CVAT 1.6.0 through 2.64.0
Timeline
- 2026-05-21: disclosed
- 2026-05-19: patched: Fix commit 6fda3e3