CVE-2025-68430

MEDIUM EPSS 15.0%
Published Dec 19, 20256mo ago · Modified Jun 17, 20262w ago
5.3 CVSS 4.0
Medium
Find Similar
Published Dec 19, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch. No known workarounds are available.

CVSS Details

Base Score
5.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
15.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-24

Affected Products 1

VendorProductVersionRange
cvatcomputer_vision_annotation_tool*≥2.8.1  –  <2.53.0

References 2

  • github.com https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c71cff4eafcf11bfcaa5f91
    Patch
  • github.com https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/cvat-ai/cvat/commit/2c24ef0c3f8fd94f6c71cff4eafcf11bfcaa5f91
    Patch
  • github.com https://github.com/cvat-ai/cvat/security/advisories/GHSA-3g7v-xjh7-xmqx
    PatchThird Party Advisory