PT-2025-26837 · Cvat · Cvat

Speclad · Published 2025-06-25 · Updated 2025-06-25 · CVE-2025-49135

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: CVAT versions 2.2.0 through 2.39.0

Description: CVAT is an open source interactive video and image annotation tool for computer vision. The issue arises from the lack of validation during the import process of a project or task backup, allowing an attacker with a CVAT account and a user role to potentially access and steal data by creating projects or tasks using files belonging to other users, if they know the filenames of those uploads. This issue does not affect annotation or dataset TUS uploads.

Recommendations: For CVAT versions 2.2.0 through 2.39.0, upgrade to CVAT 2.40.0 or a later version to receive a patch. As a temporary workaround, consider restricting access to the import process of project or task backups to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-49135

GHSA-FRPR-5W6Q-HH4F

Affected Products

Cvat

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49135.json · Exploit
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-frpr-5w6q-hh4f · Vendor Advisory
• https://github.com/cvat-ai/cvat/commit/dbafd9c0287489bea00e1db626f64b107f90bfc9 · Patch
• https://osv.dev/vulnerability/CVE-2025-49135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49135 · Security Note
• https://twitter.com/VulmonFeeds/status/1937913722208428050 · Twitter Post
• https://twitter.com/CVEnew/status/1937898587725390151 · Twitter Post
• https://t.me/cvetracker/27021 · Telegram Post