PT-2025-26837 · Cvat · Cvat

Speclad · Publicado 2025-06-25 · Atualizado 2025-06-25 · CVE-2025-49135

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CVAT versions 2.2.0 through 2.39.0

Description: CVAT is an open source interactive video and image annotation tool for computer vision. The issue arises from the lack of validation during the import process of a project or task backup, allowing an attacker with a CVAT account and a user role to potentially access and steal data by creating projects or tasks using files belonging to other users, if they know the filenames of those uploads. This issue does not affect annotation or dataset TUS uploads.

Recommendations: For CVAT versions 2.2.0 through 2.39.0, upgrade to CVAT 2.40.0 or a later version to receive a patch. As a temporary workaround, consider restricting access to the import process of project or task backups to minimize the risk of exploitation.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-49135

GHSA-FRPR-5W6Q-HH4F

Produtos afetados

Cvat

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49135.json · Exploit
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-frpr-5w6q-hh4f · Aviso do Fabricante
• https://github.com/cvat-ai/cvat/commit/dbafd9c0287489bea00e1db626f64b107f90bfc9 · Correção
• https://twitter.com/VulmonFeeds/status/1937913722208428050 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1937898587725390151 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-49135 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-49135 · Nota de Segurança
• https://t.me/cvetracker/27021 · Publicação no Telegram